ModSecurity 2.7.1是否可以与ASP.NET MVC 3一起使用？

我试图让ModSecurity 2.7.1与ASP.NET MVC 3网站一起工作。 安装运行没有错误，并查看事件日志，ModSecurity成功启动。 我正在使用modsecurity.conf-recommended文件来设置基本规则。

我遇到的问题是，每当我张贴一些表单数据，它不会通过控制器操作（或模型联编程序）。

我有SecRuleEngine设置为DetectionOnly 。

我有SecRequestBodyAccess设置为On 。

• 强制IIS提示input凭据
• 带有ASP.NET MVC的IIS6上的无扩展URL
• SQL Azure中的客户数据是否安全？
• 无法在IIS 7.5上运行MVC3
• IIS HTTP错误403.18 – ASP.NET MVC 3（PHP 5.3安装？）

使用这些设置，POST的主体永远不会到达控制器操作。 如果我将SecRequestBodyAccess设置为Off它就可以工作，所以这肯定是ModSecurity转发正文数据的方法。 ModSecuritydebugging显示以下内容（看起来好像全部通过）：

 Second phase starting (dcfg 94b750). Input filter: Reading request body. Adding request argument (BODY): name "[0].IsSelected", value "on" Adding request argument (BODY): name "[0].Quantity", value "1" Adding request argument (BODY): name "[0].VariantSku", value "047861" Adding request argument (BODY): name "[1].Quantity", value "0" Adding request argument (BODY): name "[1].VariantSku", value "047862" Input filter: Completed receiving request body (length 115). Starting phase REQUEST_BODY. Recipe: Invoking rule 94c620; [file "*********************"] [line "54"] [id "200001"]. Rule 94c620: SecRule "REQBODY_ERROR" "!@eq 0" "phase:2,auditlog,id:200001,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:%{reqbody_error_msg},severity:2" Transformation completed in 0 usec. Executing operator "!eq" with param "0" against REQBODY_ERROR. Operator completed in 0 usec. Rule returned 0. Recipe: Invoking rule 5549c38; [file "*********************"] [line "75"] [id "200002"]. Rule 5549c38: SecRule "MULTIPART_STRICT_ERROR" "!@eq 0" "phase:2,auditlog,id:200002,t:none,log,deny,status:44,msg:'Multipart request body failed strict validation: PE %{REQBODY_PROCESSOR_ERROR}, BQ %{MULTIPART_BOUNDARY_QUOTED}, BW %{MULTIPART_BOUNDARY_WHITESPACE}, DB %{MULTIPART_DATA_BEFORE}, DA %{MULTIPART_DATA_AFTER}, HF %{MULTIPART_HEADER_FOLDING}, LF %{MULTIPART_LF_LINE}, SM %{MULTIPART_MISSING_SEMICOLON}, IQ %{MULTIPART_INVALID_QUOTING}, IP %{MULTIPART_INVALID_PART}, IH %{MULTIPART_INVALID_HEADER_FOLDING}, FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'" Transformation completed in 0 usec. Executing operator "!eq" with param "0" against MULTIPART_STRICT_ERROR. Operator completed in 0 usec. Rule returned 0. Recipe: Invoking rule 554bd70; [file "********************"] [line "80"] [id "200003"]. Rule 554bd70: SecRule "MULTIPART_UNMATCHED_BOUNDARY" "!@eq 0" "phase:2,auditlog,id:200003,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'" Transformation completed in 0 usec. Executing operator "!eq" with param "0" against MULTIPART_UNMATCHED_BOUNDARY. Operator completed in 0 usec. Rule returned 0. Recipe: Invoking rule 554cbe0; [file "*********************************"] [line "94"] [id "200004"]. Rule 554cbe0: SecRule "TX:/^MSC_/" "!@streq 0" "phase:2,log,auditlog,id:200004,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'" Rule returned 0. Hook insert_filter: Adding input forwarding filter (r 5541fc0). Hook insert_filter: Adding output filter (r 5541fc0). Initialising logging. Starting phase LOGGING. Recording persistent data took 0 microseconds. Audit log: Ignoring a non-relevant request. 

我在小提琴手里看不到什么不寻常的东西。 我在我的动作参数中使用ViewModel 。 如果SecRequestBodyAccess设置为On SecRequestBodyAccess绑定任何数据。 我甚至logging所有的Request.Form.Keys和值通过log4net，但没有得到任何值。

我开始怀疑ModSecurity实际上是否适用于ASP.NET MVC，或者是否与ModSecurity http模块和模型绑定器有冲突。

有没有人有任何build议，或任何人都可以确认他们ModSecurity与ASP.NET MVC网站工作？

 SecStreamInBodyInspection On