ASP.NET form posts arrive empty with the WAF installed

Symptom#

On a server with ModSecurity for IIS with OWASP Core Rule Set installed, ASP.NET Web Forms and MVC applications behave as if the visitor sent an empty form:

a login page answers "user name is required" or "invalid login" although the visitor typed both fields,
contact and order forms lose their fields or fail validation,
Request.Form is empty in the application, while the browser's developer tools show the POST with its body.

It happened even with the firewall in Detection only mode, where nothing is blocked, and it affected ASP.NET applications in particular.

Cause#

With request body access switched on, ModSecurity for IIS reads the body of each POST request to inspect it, and in doing so consumes it. IIS then hands the ASP.NET application a request whose body has already been read, so the application sees no form fields. Earlier StackRegent releases generated a ModSecurity configuration with request body access on.

Fix: update to StackRegent 0.17.15 or later#

StackRegent 0.17.15 changed the generated configuration to SecRequestBodyAccess Off. Servers with the firewall installed rewrite their configuration once after the update, by themselves; you do not have to save anything.

Go to Tools & Settings › Updates, click Check now and install the newest release. See updating StackRegent if no release is offered.
Check the installed version at the bottom of the panel menu or with stackregent version.
Open Task Manager and check that the web application firewall task queued after the update finished without errors.
Test the form again.

The firewall now checks addresses, query strings and headers, not the bodies of posted forms. Attacks carried in the URL, cookies or headers are still detected and, in On mode, blocked with HTTP 403. Applications must still validate their input and use parameterized database queries, which is good practice with any WAF.

If you cannot update right now#

Take ModSecurity out of the path for the affected site until you can update:

Go to Tools & Settings › Web Application Firewall.
On the Websites tab, set the website's mode to Off. Setting a website to Off removes ModSecurity from that site entirely, so its form posts reach the application again.

Alternatively, set the server-wide Mode to Off on the Settings tab. Switching off single rules is not enough, because the problem comes from reading the body, not from a rule.

After the update, set the website back to the server default.

Still empty after the update?#

If posts still arrive empty with the current release, the cause lies elsewhere. Check the website's Logs and Failed Request Tracing for the request, look for a web.config request filtering or URL Rewrite rule that changes POST requests, and check whether the form posts to http:// and is redirected to https://: a 301 redirect turns a POST into a GET, which drops the body. Make the form post to the https:// address directly.

The security chapter describes the firewall's settings and modes.

Frequently asked questions

Which StackRegent version fixed empty ASP.NET form posts?

StackRegent 0.17.15. From that release the ModSecurity configuration no longer inspects request bodies, and servers with the firewall installed rewrite the configuration once after updating.

Does the StackRegent WAF still protect my sites without body inspection?

Yes, for what arrives in addresses, query strings and headers, which the OWASP Core Rule Set checks as before. Content of posted forms is not inspected, so applications must handle form input safely themselves.

Did detection-only mode avoid the problem?

No. ModSecurity for IIS consumed request bodies even in detection-only mode, so form posts arrived empty without anything being blocked. Updating, or setting the site to Off, is the fix.