title: modsecurity: SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
body: <p>Modsecurity question...</p>
  
  <p>What is the <code>REQUEST_METHOD</code> test doing in the following? It appears twice.</p>
  
  <p><strong><code>SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"</code></strong></p>
  
  <hr>
  
  <pre><code>SecRule &amp;REQUEST_HEADERS:Accept "@eq 0" \
      "chain,phase:2,skip:1,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
  SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
  SecRule REQUEST_HEADERS:Accept "^$" \
      "chain,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
  SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
  SecRule &amp;REQUEST_HEADERS:User-Agent "@eq 0" \
      "skip:1,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
  SecRule REQUEST_HEADERS:User-Agent "^$" \
      "t:none,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
  SecMarker 969999
  </code></pre>
  
  <hr>
  
  <p>Please, don't explain the whole thing, I can read everything else. It looks like the <code>REQUEST_METHOD</code> test, however, is some sort of voodoo...</p>
  
  <p>BTW, the test of the <code>Accept</code> is wrong. The <code>Accept</code> option is not mandatory as per <em>HTTP</em>.</p>