Rule set
OWASP CRS 4.25.0, paranoia level 1, inbound anomaly threshold 5
Original WAFWiki lab
OWASP CRS False Positive Test: 12 Clean Requests
Clean-traffic regression test for ModSecurity and Coraza with 12 HTTP 200 decisions, six input patterns, zero blocking mismatches, and one repeatable numeric Host warning.
Lab status
- Product
- OWASP CRS 4.25.0 clean-traffic regression
- Status
- Completed hands-on test
- Updated
- 2026-07-26
Evidence policy
WAFWiki separates verified smoke-test results from architecture diagrams and methodology notes. A smoke test proves one narrow local path; it does not claim full production readiness.
Environment
Reproducibility notes
Clean patterns
Simple query, order-style JSON, email, versioned documentation path, status filter, and C++ search term
Decision count
Six requests per stack, 12 clean HTTP decisions total
Host header
curl default numeric localhost host with ports 18181 and 18182
Observed warning
CRS rule 920350: Host header is a numeric IP address
Blocking result
No clean request reached the inbound anomaly threshold in this matrix
Commands
How this lab can be reproduced
Run the clean and controlled matrix
scripts/run-waf-evidence-lab.shThe final CSV contains 12 clean rows and eight controlled SQLi/XSS rows.
Show clean decisions
awk -F, 'NR == 1 || $2 ~ /^clean/ { print }' \
docs/lab-evidence/waf-engine-comparison-2026-07-26-requests.csvThe clean subset shows HTTP 200 for every recorded engine and case.
Inspect the numeric Host warning
rg '920350|Host header is a numeric IP address' \
docs/lab-evidence/waf-engine-comparison-2026-07-26-*.logBoth logs contain protocol-enforcement warnings caused by the localhost numeric Host header.
Observed result
What the hands-on test showed
Clean HTTP decisions
12 / 12 returned 200
No selected clean request was blocked by either stack.
Blocking mismatches
0 observed
Every clean case matched the expected status, but the sample is too small for a general false-positive rate.
Warning noise
Rule 920350 repeated
Numeric localhost Host headers were logged as protocol warnings even though requests remained allowed.
Operational lesson
Review alerts, not only blocks
A clean regression should evaluate log noise and alert routing as well as HTTP interruption.
clean-query: 200 on ModSecurity and Coraza
clean-json: 200 on ModSecurity and Coraza
clean-email: 200 on ModSecurity and Coraza
clean-version-path: 200 on ModSecurity and Coraza
clean-filter: 200 on ModSecurity and Coraza
clean-code-term: 200 on ModSecurity and Coraza
log nuance: CRS 920350 warned on the numeric Host headerEvidence context
The clean regression compared decisions and log side effects.
HTTP 200 alone is not enough. The numeric Host warning demonstrates why teams should capture alerts, anomaly contributions, and operational noise while validating normal workflows.
Open evidence
Download the sanitized result files.
The files expose the status matrix and versioned summary without publishing raw container logs or unrelated local data.
Download request matrix CSV
Twenty request outcomes with engine, case, method, path, expected status, observed status, and curl time.
Download evidence summary JSON
Pinned image IDs, component versions, host details, request results, latency samples, resource snapshots, and limitations.
Limitations
What this result does not prove
- Six clean patterns per engine cannot produce a statistically meaningful false-positive rate.
- The numeric Host header is a localhost artifact; the regression must be repeated with real hostnames and headers.
- Login, logout, password reset, uploads, API clients, admin consoles, encoded search, international text, and large requests were not included.
- A production test should sample real route frequency and business impact, not count every synthetic request equally.
Related research