mod_security: A rule to allow POST requests without a request body

Question

I have Apache 2.4 and mod_security 2.9.1 installed, and it is working, with some very basic rules.

I am trying to make a POST request that includes some header info

Answer 1

You can disable body access for a request with zero body length:

SecRule REQUEST_BODY_LENGTH "@eq 0" "id:12345,phase:1,nolog,ctl:requestBodyAccess=off"

Or if you only want to do this on a certain URL then use a chained rule like this:

SecRule REQUEST_URI /my/weird/api "phase:1,id:12346,nolog,chain"
   SecRule REQUEST_BODY_LENGTH "@eq 0" "ctl:requestBodyAccess=off"