ModSecurity rule #920420, it must be disabled to allow for JSON POST requests

I’ve run into this issue where V8 API POST requests are disallowed by ModSecurity.

Not sure what is best, I don’t have alot of options.

  1. disable modsecurity entirely for SuiteCRM domain
  2. disable that rule completely accross all domains.

Anyone ever encountered this or have another way of dealing with it?

Adding an excption in .htaccess did not seem to work for me.

Still looking for input on the best way to handle the ModSecurity issue. I know I can expand the allow in Modsecurity via SSH to include JSON. However, I’m looking for something similar that would be able to be done by the many people on shared hosting who don’t have access directly to Apache. I was really hoping an .htaccess rule to turn off that rule for the API directory would work but haven’t been successful.

In the meantime I put together a list of all the possible reasons the V8 API might not be working (ask me how I found out LOL!). Hopefully it helps someone else: