IIS 10 + ModSec 2.9.1 breaks websocket/socket.io even if turned off

[globules-io]

1. IIS 10 + socket.io = OK
2. Install mod sec 2.9.1 x64
3. Use default config file
4. Socket.io = Broken (can't connect from client)
5. Turn off Mod Sec in Server = no change
6. Turn off Mod Sec in web.config in site = no change
7. Uninstall Mod Sec = IIS broken (some config files broken)
8. Reinstall Mod Sec = see step 3
   Pls help

[globules-io]

Found one error : when uninstalling modsec (windows server/IIS), there are some leftovers in applicationHost.config (<ModSecurity enabled=false"/>) if you have set that rule per site and not globally. This causes IIS to refuse to start with an error 500.
That being fixed, my sockets are now properly working again (running on port 8080).

[victorhora]

Hi @globules-io, looks like the uninstaller is a bit buggy. I'll have a look at it.

In the meantime, were you able to solve your issue? If not, please try going over these instructions to see if it solves your problem:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#installation-for-microsoft-iis

https://github.com/SpiderLabs/ModSecurity/wiki/IIS-Troubleshooting

[globules-io]

I could solve the issue by removing by hand any mention of ModSecurity inside applicationHost.config. My only issue left is that, for some reason, ModSec blocks another process running on port 8080 (socket.io). Note that socket.io here is not handled by IIS so any modification to IIS should not have effect on this I suppose. So my only issue is how to allow that process on 8080 while ModSec is installed on IIS?

[globules-io]

Any update on this? Any of it solved?

[victorhora]

Hi @globules-io

As a follow up from uninstallation issues: When uninstalling, please try to run the .msi as Administrator or using msiexec. See #1868 (comment) for more information.

As for the issue you described about ModSec blocking other process on a different port, I could not reproduce it here. I'm wondering if it's any particularity on your environment?

Please check if with a fresh installation of Windows + IIS + ModSecurity 2.9.3 + Socket.io the issue stills persists. If so, please let us know and we can reopen the issue to investigate further if it's an issue with ModSecurity for IIS.

Thanks.