2

I have a .net core web application with signalR elements which works pretty fine locally.

When I publish the application on my host (windows server, plesk, .net framework 4.8), I get an error as follows:

Error

Backend

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using Microsoft.AspNet.SignalR;

public class ChatHub : Hub
{
public void SendAll(string userid, string message)
{
(new Messages()).addMessage(message, DateTime.Now, userid);
string name = (new Users(userid)).getname();
Clients.All.broadcastMessage(name, DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss"), message);
}
}

Header

\<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js"  type="text/javascript"\>\</script\>
\<script src="https://cdnjs.cloudflare.com/ajax/libs/signalr.js/2.4.1/jquery.signalR.min.js"\>\</script\>

JS

$.connection.hub.url = "/signalr";
$.connection.hub.start({ transport: 'longPolling' }).done(function() {
console.log("hub connection is made");
}).fail(function() {
console.log("connection to the hub has been failed");
});
morteza davari
  • 21
  • 1

2 Answers2

1

The problem is not with your website, but with Plesk settings Ask the support of the service provider to disable ModSecurity in Plesk for your service ,if you have access yourself, you can do as follows :

How to disable specific ModSecurity rules in Plesk per domain or server-wide

Mohammad Aghazadeh
  • 2,108
  • 3
  • 9
  • 20
  • Thanks, that solves the issue. However, I don't want to completely disable the firewall. How can I know which security codes should I allow? – morteza davari Dec 23 '22 at 19:07
  • Secure your app as a developer. disabling ‍‍`modesecurity` won't cause you any problems. The topic of firewall and server settings should not be your concern, but it is related to your service provider – Mohammad Aghazadeh Dec 23 '22 at 19:13
0

From comments: "How can I know which security codes should I allow?" --> When you look into your error_log, you'll find entries like

[client <IP Adresse>] ModSecurity: [file /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf"] [line "258"] [id "33350147"] [rev "143"] [msg "Protected by Atomicorp.com Basic Non-Realtime WAF Rules: Potentially Untrusted Web Content Detected"] [data ""] [severity "CRITICAL"] ...

The "id" bracket gives you the rule id that you can enter into the exceptions list in your Plesk "Web Application Firewall". In the example above that would be rule no. 33350147.

Don't allow many exceptions. Most rules make perfect sense. Only add rules to exceptions where you are sure that they are false positives.

Thomas
  • 86
  • 5