Skip to content

Make the wording of the OWASP action documentation more approachable. #1619

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+27 −36
Open

Make the wording of the OWASP action documentation more approachable. #1619

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
114fd52
Make the wording of the OWASP action documentation more approachable.
samwho Oct 2, 2025
2a14efc
Fix small copy-paste error.
samwho Oct 2, 2025
305a269
Update traffic-policy/actions/owasp-crs-request.mdx
S3Prototype Oct 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 14 additions & 18 deletions traffic-policy/actions/owasp-crs-request.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,35 +1,31 @@
---
title: OWASP CRS Request Action
sidebarTitle: OWASP CRS Request
description: The OWASP CRS Request Traffic Policy action enables OWASP CRS for use with ModSecurity or compatible web application firewalls.
description: Block common web attacks with the `owasp-crs-request` action in Traffic Policy.
---

import ActionExamples from "/snippets/traffic-policy/actions/owasp-crs-request/examples/index.mdx";
import ActionVariablesDescription from "/snippets/traffic-policy/common/action-variables-description.mdx";
import { YouTubeEmbed } from "/snippets/YouTubeEmbed.jsx";
import { YouTubeEmbed } from "/snippets/TrafficPolicy.jsx";
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
import { YouTubeEmbed } from "/snippets/TrafficPolicy.jsx";
import { YouTubeEmbed } from "/snippets/YouTubeEmbed.jsx";

Typo?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Eep, yes, sorry! I had played with creating a custom component that would allow us to specify the Traffic Policy file just once, and then it would automatically render the two-pane YAML/JSON variant. I hit snags that I didn't know how to overcome, though.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah mintlify has some limitations that I hope to work around soon by creating exactly the component you're describing


import { ConfigField } from "/snippets/ConfigTable.jsx";
import { ConfigChildren } from "/snippets/ConfigChildren.jsx";

The **OWASP CRS Request** Traffic Policy action enables OWASP (Open Worldwide Application
Security Project) CRS (previously Core Rule Set), a set of generic attack detection
rules for use with ModSecurity or compatible web application firewalls. It aims to protect
web applications from a wide range of attacks, including the
[OWASP Top Ten](https://owasp.org/www-project-top-ten/), with a minimum of false alerts.
CRS provides protection against many common attack categories, including SQL Injection,
Cross Site Scripting, Local File Inclusion, etc.

The `owasp-crs-request` action only enables rule processing on _incoming_ HTTP requests to your
endpoint. In addition to this action, we also recommend you enable the [OWASP CRS Response
action](/traffic-policy/actions/owasp-crs-response/) to analyze _outgoing_ HTTP responses from your endpoint.


## Video walkthrough

The following video walks you through ngrok's OWASP CRS request and response actions in Traffic Policy, which let you add web application firewall protection directly to your ngrok endpoints without changing your existing infrastructure.
[OWASP](https://owasp.org/) stands for the Open Web Application Security
Project, an online community that, among other things, maintains annual lists of
the most critical web application security risks. The [OWASP Core Rule
Set](https://owasp.org/www-project-modsecurity-core-rule-set/) (CRS) is a set of
attack detection rules that we expose for you to use in your Traffic Policies.
It includes protections against attacks like SQL Injection, Cross Site
Scripting, Local File Inclusion, and many others.

<YouTubeEmbed videoId="HHxj5VGFTEA" title="Block web attacks with ngrok's OWASP CRS Request" />

The `owasp-crs-request` action enables rule processing on incoming HTTP
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this paragraph should be moved to the top since the page is primarily about the OWASP request action, not OWASP in general. I do think the paragraph you have explaining OWASP and CRS is good, but feels less appropriate as the intro

requests to your endpoint. We recommend you also enable the [OWASP CRS Response
action](/traffic-policy/actions/owasp-crs-response/) to block attacks where
it's the response that is malicious.
Comment on lines +25 to +27
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
requests to your endpoint. We recommend you also enable the [OWASP CRS Response
action](/traffic-policy/actions/owasp-crs-response/) to block attacks where
it's the response that is malicious.
requests to your endpoint. To use rule processing to block malicious HTTP _responses_, enable the [OWASP CRS Response
action](/traffic-policy/actions/owasp-crs-response/).
<Tip>
We recommend using both actions.
</Tip>

Condensed this a bit and changed the language to keep the emphasis on the difference here, so readers who are skimming can understand what we're saying a little easier. Also added a callout to really highlight that we recommend using both.


### Configuration Reference

This is the [Traffic Policy](/traffic-policy/) configuration
Expand Down
31 changes: 13 additions & 18 deletions traffic-policy/actions/owasp-crs-response.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: OWASP CRS Response Action
sidebarTitle: OWASP CRS Response
description: The OWASP CRS Response action enables OWASP Core Rule Set (CRS) to analyze outgoing HTTP responses from your endpoint and protect against common web attacks.
description: Block common web attacks with the `owasp-crs-response` action in Traffic Policy
---

import ActionVariablesDescription from "/snippets/traffic-policy/common/action-variables-description.mdx";
Expand All @@ -10,25 +10,20 @@ import { YouTubeEmbed } from "/snippets/YouTubeEmbed.jsx";
import { ConfigField } from "/snippets/ConfigTable.jsx";
import { ConfigChildren } from "/snippets/ConfigChildren.jsx";

The **OWASP CRS Response** Traffic Policy action enables OWASP (Open Worldwide Application
Security Project) CRS (previously Core Rule Set), a set of generic attack detection
rules for use with ModSecurity or compatible web application firewalls. It aims to protect
web applications from a wide range of attacks, including the
[OWASP Top Ten](https://owasp.org/www-project-top-ten/), with a minimum of false alerts.
CRS provides protection against many common attack categories, including SQL Injection,
Cross Site Scripting, Local File Inclusion, etc.
[OWASP](https://owasp.org/) stands for the Open Web Application Security
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as the above, I think the other paragraph should be the intro and this should be the second paragraph

Project, an online community that, among other things, maintains annual lists of
the most critical web application security risks. The [OWASP Core Rule
Set](https://owasp.org/www-project-modsecurity-core-rule-set/) (CRS) is a set of
attack detection rules that we expose for you to use in your Traffic Policies.
It includes protections against attacks like SQL Injection, Cross Site
Scripting, Local File Inclusion, and many others.

The `owasp-crs-response` action only enables rule processing on _outgoing_ HTTP responses from your
endpoint. In addition to this action, we also recommend you enable the [OWASP CRS Request
action](/traffic-policy/actions/owasp-crs-request/) to analyze _incoming_ HTTP requests to your endpoint.
<YouTubeEmbed videoId="HHxj5VGFTEA" title="Block web attacks with ngrok's OWASP CRS Request" />

## Video walkthrough

The video below walks you through ngrok's OWASP CRS request and response actions in Traffic Policy, which let you add web application firewall protection directly to your ngrok endpoints without changing your existing infrastructure.

<YouTubeEmbed videoId="HHxj5VGFTEA" title="Block web attacks with ngrok's OWASP CRS Response" />

<ActionOverview />
The `owasp-crs-response` action enables rule processing on incoming HTTP
requests to your endpoint. We recommend you also enable the [OWASP CRS Request
action](/traffic-policy/actions/owasp-crs-request/) to block attacks where
it's the request that is malicious.
Comment on lines +23 to +26
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The `owasp-crs-response` action enables rule processing on incoming HTTP
requests to your endpoint. We recommend you also enable the [OWASP CRS Request
action](/traffic-policy/actions/owasp-crs-request/) to block attacks where
it's the request that is malicious.
The `owasp-crs-response` action enables rule processing on incoming HTTP
requests to your endpoint. To use rule processing to block malicious HTTP _requests_, enable the [OWASP CRS Request
action](/traffic-policy/actions/owasp-crs-request/) action.
<Tip>
We recommend using both actions.
</Tip>

Similar change to what I suggested in the request page.


### Configuration Reference

Expand Down