docs(known-issues): document early blocking

[fzipi]

what

• document early blocking problems as known issues

Fixes#221

[cloudflare-workers-and-pages]

Deploying crs-documentation with Cloudflare Pages

Latest commit:	e2e4c3a
Status:	✅ Deploy successful!
Preview URL:	https://cb78cb5b.documentation-km5.pages.dev
Branch Preview URL:	https://chore-add-early-blocking-doc.documentation-km5.pages.dev

View logs

[theseion]

I think this is the wrong way around. @airween? Didn't the issue say they used --disable-request-early?

[airween]

Yes, @theseion is right. I think we should suggest don't use --disable-request-early flag.

[fzipi]

Ugh. Is it just the name, or the behavior completely changes? Can you point me to the docs?

[airween]

I just found this one:

Starting with ModSecurity 2.7.0 there are a few important configuration options

3. --enable-request-early - On ModSecurity 2.6 phase one has been moved to phase 2 hook, if you want to play around it use this option.

But in configure.ac, the logic is in opposite direction:

 if test "$enableval" != "no"; then
request_early="-DREQUEST_EARLY"
MODSEC_EXTRA_CFLAGS="$MODSEC_EXTRA_CFLAGS $request_early"
else
request_early=
fi
],
[
request_early='-DREQUEST_EARLY'

The logic:

• if the user passes this option, and the value is not no (which equals with --disable-request-early, then feature will be turned ON
• if the user does not pass this option, then the build script assumes it's necessary and will be turned ON

[Xhoenix]

Any updates on this?

[Xhoenix]

Ping @coreruleset/core-developers

[fzipi]

@Xhoenix Did my best. Can you re-review?

[Xhoenix]

The ModSec Docs conflict with this --disable-request-early flag, and suggest --enable-request-earlyhttps://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-%28v2.x%29#start-apache-httpd. Maybe the Docs need to be updated.

[fzipi]

@airween Do you know the right answer here? Do we need to update the modsecurity docs first, and then this one?

[Copilot]

Pull request overview

This PR documents the --enable-request-early ModSecurity compilation flag in the CRS known issues section, addressing issue #221. The documentation explains why this flag should remain disabled by default and describes the risks associated with enabling it. Additionally, the PR reorganizes the existing known issues with improved formatting using emojis for better visual structure.

Changes:

• Added comprehensive documentation for ModSecurity's --enable-request-early flag including motivation, technical details, risks, and recommendations
• Reorganized existing known issues into categorized sections (Apache, ModSecurity, Debian, CRS + ModSecurity, libmodsecurity3)
• Enhanced visual structure with emoji icons for improved readability

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.