feat: resolve common false positives with ad and tracker cookies by EsadCetiner · Pull Request #4378 · coreruleset/coreruleset

EsadCetiner · 2025-12-09T08:37:42Z

Proposed changes

This PR resolves false positives with the new Google tracking cookies and a few other common tracking/ad cookies. I've moved the existing cookie exceptions to it's own file REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf to improve the overall maintainability of these exceptions. The 999 in the filename is to ensure that the file is loaded after all the request rules have been created.

closes #4370

supersedes: #4293

PR Checklist

I have read the CONTRIBUTING doc
I have added positive tests proving my fix/feature works as intended.
I have added negative tests that prove my fix/feature considers common cases that might end in false positives
In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
My test use the comment field to write the expected behavior
I have added documentation for the rule or change (when appropriate)

Further comments

For the reviewer

Positive and negative tests were added
Tests cover the intended fix/feature properly
No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
In case a regular expression was changed, there is no ReDOS
Documentation is clear for the rule/change

github-actions · 2025-12-09T08:38:12Z

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

fzipi · 2026-01-18T13:48:27Z

@EsadCetiner CRS provides the file RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example for people to modify by copying it as RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf. This will overwrite any files that people might have, so it is a bad choice.

EsadCetiner · 2026-01-19T03:27:18Z

@fzipi I'm confused, how will REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf conflict with RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example? They are different files.

fzipi · 2026-01-19T12:44:27Z

Ugh, I'm sorry. Read it twice, and couldn't separate the two names apart 🤦 .

fzipi · 2026-01-20T12:13:55Z

Do we plan to have tests?

Co-authored-by: Felipe Zipitría <3012076+fzipi@users.noreply.github.com>

EsadCetiner · 2026-01-21T04:10:03Z

@fzipi I don't have any tests for the Matomo cookie since I don't use it, I'll add tests for the others.

EsadCetiner · 2026-01-21T04:36:08Z

@fzipi Added tests

fzipi · 2026-01-21T14:02:47Z

We should add a new linting rule that prevents adding exceptions to request cookies in SecRules. I'll create a followup in the crs-linter repo.

Copilot

Pull request overview

This PR introduces a new dedicated file for common cookie exceptions to address false positives with tracking and advertising cookies, particularly Google's newer tracking cookies and other widely-used ad/tracking services. The change improves maintainability by consolidating cookie exceptions that were previously inline in rule files.

Changes:

Created new file REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf containing exceptions for common tracking/ad cookies (Google Analytics, Google Ads, Microsoft Clarity, Prebid.js, AWS Load Balancer, and Matomo)
Removed inline !REQUEST_COOKIES:/_pk_ref/ exceptions from SQLi and XSS rule files, moving them to the new centralized file
Added comprehensive test suite with 10 test cases covering all new cookie exceptions

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
`rules/REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf`	New file containing centralized cookie exceptions for common tracking/advertising cookies with the `999` prefix ensuring it loads after request rules
`rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf`	Removed inline `!REQUEST_COOKIES:/_pk_ref/` exceptions from multiple SQLi detection rules (942380, 942390, 942400, 942410, 942420, 942421, 942440, 942450, 942470, 942480)
`rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf`	Removed inline `!REQUEST_COOKIES:/_pk_ref/` exceptions from XSS detection rules (941320, 941330, 941340)
`tests/regression/tests/REQUEST-999-COMMON-EXCEPTIONS-AFTER/999999.yml`	Added test suite verifying that legitimate tracking/ad cookies do not trigger WAF rules

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

fzipi

I think this is in good shape now.

EsadCetiner added 3 commits December 9, 2025 19:27

feat: resolve common false positives with ad and tracker cookies

b85e3fd

Merge branch 'coreruleset:main' into fix-common-cookie-fp

8e61db2

up

ebb2791

This was referenced Dec 9, 2025

Excessive false positives in rules 941100, 942290, 942550 for advertising/tracking cookies #4370

Closed

fix(942420): Clarify false positives and exclusions for SQLI rule #4293

Closed

theseion mentioned this pull request Jan 5, 2026

Monthly Chat Agenda January 2026 (2026-01-05) #4392

Closed

github-actions Bot added the Stale label Jan 9, 2026

EsadCetiner added release:new-feature This PR introduces a new feature release:fix and removed Stale labels Jan 12, 2026

fzipi reviewed Jan 20, 2026

View reviewed changes

Comment thread rules/REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf Outdated

Comment thread rules/REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf Outdated

Comment thread rules/REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf

Comment thread rules/REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf

Apply suggestions from code review

d0819fe

Co-authored-by: Felipe Zipitría <3012076+fzipi@users.noreply.github.com>

EsadCetiner added 2 commits January 21, 2026 15:11

Merge branch 'main' into fix-common-cookie-fp

66677ab

test: add tests for exclusions

75a3c6e

fix: linter warning

3b42fdc

fzipi requested a review from Copilot January 21, 2026 13:59

Copilot started reviewing on behalf of fzipi January 21, 2026 13:59 View session

fzipi mentioned this pull request Jan 21, 2026

Add new linting rule for preventing SecRule directives to remove targets from REQUEST_COOKIES coreruleset/crs-linter#112

Open

Copilot AI reviewed Jan 21, 2026

View reviewed changes

EsadCetiner and others added 3 commits January 22, 2026 10:26

Apply suggestions from code review

ea3b589

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestions from code review

627cc54

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

remove extra whitespace

2448e5f

fzipi approved these changes Jan 22, 2026

View reviewed changes

EsadCetiner added this pull request to the merge queue Jan 22, 2026

Merged via the queue into coreruleset:main with commit e4d3374 Jan 22, 2026
9 of 10 checks passed

EsadCetiner deleted the fix-common-cookie-fp branch January 22, 2026 01:12

theseion mentioned this pull request Feb 2, 2026

Monthly Chat Agenda February 2026 (2026-02-02) #4438

Closed

Uh oh!

Conversation

EsadCetiner commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

PR Checklist

Further comments

For the reviewer

Uh oh!

github-actions Bot commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fzipi commented Jan 18, 2026

Uh oh!

EsadCetiner commented Jan 19, 2026

Uh oh!

fzipi commented Jan 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fzipi commented Jan 20, 2026

Uh oh!

EsadCetiner commented Jan 21, 2026

Uh oh!

EsadCetiner commented Jan 21, 2026

Uh oh!

fzipi commented Jan 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fzipi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

EsadCetiner commented Dec 9, 2025 •

edited

Loading

github-actions Bot commented Dec 9, 2025 •

edited

Loading