Fix: method exceptions now only allow the methods you list
Method exceptions (Rules → Method Exceptions) let specific source IPs use HTTP methods that a site otherwise rejects. On the WAF side, an exception switched off the OWASP CRS "method is not allowed by policy" check (rule 911100) for every method from those IPs, not just the ones listed. For example, an exception for PUT also let DELETE and PATCH from the same IPs pass that check.
The exception now applies only when both the source IP and the method match. Requests from other IPs, and unlisted methods from the listed IPs, are checked as normal.
⚠️ Read before upgrading if you use method exceptions
If a client depended on an exception for methods it doesn't list, those requests will be blocked with 403 after this upgrade. Check Rules → Method Exceptions and add any methods your clients actually need before you upgrade. Afterwards, check WAF Logs for rule 911100 blocks.
No other steps are needed. The admin API rewrites the WAF configuration automatically when it starts.
Upgrade
docker compose pull
docker compose up -d
latest points to this release. If you pin versions, set WAF_IMAGE_TAG=1.0.24 (no v prefix) before pulling.
Images: ghcr.io/socfortress/waf-caddy:1.0.24, ghcr.io/socfortress/waf-admin-api:1.0.24, ghcr.io/socfortress/waf-admin-ui:1.0.24