diff --git a/README.md b/README.md
index c8cf1dd..da3ad59 100644
--- a/README.md
+++ b/README.md
@@ -62,9 +62,12 @@ location /t {
         coraza.do_header_filter()
         coraza.do_interrupt()
     }
+    
+    body_filter_by_lua_block{
+        coraza.do_body_filter()
+    }
 
     log_by_lua_block{
-        coraza.do_log()
         coraza.do_free_transaction()
     }
 }
@@ -76,4 +79,7 @@ if you need more log for debug, please turn on the debug on nginx.
 error_log logs/error.log debug;
 ```
 
-the matched rules log will be logged at `ngx.ctx.coraza_msg` by `coraza.do_log()`
\ No newline at end of file
+the matched rules log will be logged at `ngx.ctx.coraza_msg` by `coraza.do_log()`
+
+# TODO:
+1. block response when detected the event
\ No newline at end of file
diff --git a/lib/resty/coraza.lua b/lib/resty/coraza.lua
index 949ed6b..6d5ee0e 100644
--- a/lib/resty/coraza.lua
+++ b/lib/resty/coraza.lua
@@ -1,5 +1,6 @@
 local log = require "resty.coraza.log"
 local request = require "resty.coraza.request"
+local response = require "resty.coraza.response"
 local coraza = require "resty.coraza.coraza"
 local consts = require "resty.coraza.constants"
 
@@ -11,7 +12,7 @@ local err_fmt = log.err_fmt
 local warn_fmt = log.warn_fmt
 
 local _M = {
-    _VERSION = '1.0.2'
+    _VERSION = '1.0.0-rc2'
 }
 
 function _M.create_waf()
@@ -60,7 +61,7 @@ end
 function _M.do_free_transaction()
     local transaction = ngx.ctx.transaction
     if transaction ~= nil then
-        nlog(debug_fmt("transaction %s is freed by coraza_free_transaction", ngx.ctx.request_id))
+        nlog(debug_fmt("is freed by coraza_free_transaction"))
         ngx.ctx.transaction = nil
         coraza.free_transaction(transaction)
     end
@@ -71,7 +72,7 @@ function _M.do_handle()
     -- If request has disrupted by coraza, the transaction is freed and set to nil.
     -- Response which was disrupted doesn't make sense.
     if ngx.ctx.action ~= nil and ngx.ctx.transaction ~= nil then
-        nlog(warn_fmt([[Transaction %s request: "%s" is interrupted by policy. Action is %s]], ngx.ctx.request_id, ngx.var.request, ngx.ctx.action))
+        nlog(warn_fmt([[request: "%s" is interrupted by policy. Action is %s]], ngx.var.request, ngx.ctx.action))
         if ngx.ctx.action == "drop" or ngx.ctx.action == "deny" then
             ngx.ctx.is_disrupted = true
             return ngx.ctx.status_code, fmt(consts.BLOCK_CONTENT_FORMAT, ngx.ctx.status_code)
@@ -84,18 +85,18 @@ function _M.do_interrupt()
     -- If request has disrupted by coraza, the transaction is freed and set to nil.
     -- Response which was disrupted doesn't make sense.
     if ngx.ctx.is_disrupted == true and ngx.get_phase() == "header_filter" then
-        nlog(debug_fmt("Transaction %s has been disrupted at request phrase. ignore", 
-        ngx.ctx.request_id))
+        nlog(debug_fmt("has been disrupted at request phrase. ignore"))
         return
     end
     local status_code, block_msg = _M.do_handle()
     if status_code ~= nil then
         ngx.status = ngx.ctx.status_code
-        local ok, msg = pcall(ngx.say, block_msg)
-        if ok == false then
-            nlog(err_fmt(msg))
+        if ngx.get_phase() == "header_filter" then
+            response.clear_header_as_body_modified()
+        else
+            ngx.say(block_msg)
+            return ngx.exit(ngx.status)
         end
-        return ngx.exit(ngx.status)
     end
 end
 
@@ -103,26 +104,18 @@ function _M.do_header_filter()
     if ngx.ctx.is_disrupted == true then
         -- If request was interrupted by coraza at access_by_lua phrase, the ngx.ctx.transaction will be set nil.
         -- We can bypass the check.
-        nlog(debug_fmt("Transaction %s has been disrupted at request phrase. ignore", 
-        ngx.ctx.request_id))
+        nlog(debug_fmt("has been disrupted at request phrase. ignore"))
         return
     end
-    local h = ngx.resp.get_headers(0, true)
-    for k, v in pairs(h) do
-        coraza.add_response_header(ngx.ctx.transaction, k, v)
-    end
-    -- copy from https://github.com/SpiderLabs/ModSecurity-nginx/blob/d59e4ad121df702751940fd66bcc0b3ecb51a079/src/ngx_http_modsecurity_header_filter.c#L527
-    coraza.process_response_headers(ngx.ctx.transaction, ngx.status, "HTTP 1.1")
+
+    -- process http response headers(supports HPP)
+    response.build_and_process_header(ngx.ctx.transaction)
 
     ngx.ctx.action, ngx.ctx.status_code = coraza.intervention(ngx.ctx.transaction)
 end
 
 function _M.do_body_filter()
-    -- TODO
-end
-
-function _M.do_log()
-    coraza.process_logging(ngx.ctx.transaction)
+    response.build_and_process_body(ngx.ctx.transaction)
 end
 
 return _M
diff --git a/lib/resty/coraza/coraza.lua b/lib/resty/coraza/coraza.lua
index a79b68e..86a376d 100644
--- a/lib/resty/coraza/coraza.lua
+++ b/lib/resty/coraza/coraza.lua
@@ -144,12 +144,10 @@ function _M.new_transaction(waf)
     local ok, msg = pcall(coraza.coraza_new_transaction, waf, nil)
     if ok then
         ngx.ctx.request_id = ngx.var.request_id
-        nlog(debug_fmt("Success to creat new transaction id %s",
-            ngx.ctx.request_id))
+        nlog(debug_fmt("Success to creat new transaction"))
         return msg
     else
-        nlog(debug_fmt("Failed to creat new transaction id %s, msg: %s",
-            ngx.ctx.request_id, msg))
+        nlog(debug_fmt("Failed to creat new transaction, msg: %s", msg))
     end
 end
 
@@ -159,13 +157,13 @@ function _M.process_connection(transaction, sourceAddress, clientPort, serverHos
     local ok, msg = pcall(coraza.coraza_process_connection, transaction, cast_to_c_char(sourceAddress),
             tonumber(clientPort), cast_to_c_char(serverHost), tonumber(serverPort))
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_process_connection with " ..
+        nlog(debug_fmt("success to invoke coraza_process_connection with " ..
             "sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s",
-            ngx.ctx.request_id, sourceAddress, clientPort, serverHost, serverPort))
+            sourceAddress, clientPort, serverHost, serverPort))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_process_connection with " ..
+        nlog(err_fmt("failed to invoke coraza_process_connection with " ..
             "sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s msg: %s",
-            ngx.ctx.request_id, sourceAddress, clientPort, serverHost, serverPort, msg))
+            sourceAddress, clientPort, serverHost, serverPort, msg))
     end
 end
 
@@ -175,11 +173,11 @@ function _M.process_uri(transaction, uri, method, proto)
     local ok, msg = pcall(coraza.coraza_process_uri, transaction, cast_to_c_char(uri),
             cast_to_c_char(method), cast_to_c_char(proto))
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_process_uri with %s %s %s",
-            ngx.ctx.request_id, method, uri, proto))
+        nlog(debug_fmt("success to invoke coraza_process_uri with %s %s %s",
+                        method, uri, proto))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_process_uri with %s %s %s. msg: %s",
-            ngx.ctx.request_id, ngx.ctx.request_id, method, uri, proto, msg))
+        nlog(err_fmt("failed to invoke coraza_process_uri with %s %s %s. msg: %s",
+                      method, uri, proto, msg))
     end
 end
 
@@ -189,11 +187,11 @@ function _M.add_request_header(transaction, header_name, header_value)
     local ok, msg = pcall(coraza.coraza_add_request_header, transaction, 
     cast_to_c_char(header_name), #header_name, cast_to_c_char(header_value), #header_value)
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_add_request_header with %s:%s",
-            ngx.ctx.request_id, header_name, header_value))
+        nlog(debug_fmt("success to invoke coraza_add_request_header with %s:%s",
+                        header_name, header_value))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_add_request_header with %s:%s. msg: %s",
-            ngx.ctx.request_id, header_name, header_value, msg))
+        nlog(err_fmt("failed to invoke coraza_add_request_header with %s:%s. msg: %s",
+                    header_name, header_value, msg))
     end
 end
 
@@ -202,11 +200,11 @@ function _M.add_get_args(transaction, header_name, header_value)
     local ok, msg  = pcall(coraza.coraza_add_get_args, transaction, 
     cast_to_c_char(header_name), cast_to_c_char(header_value))
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_add_get_args with %s:%s",
-            ngx.ctx.request_id, header_name, header_value))
+        nlog(debug_fmt("success to invoke coraza_add_get_args with %s:%s", 
+                        header_name, header_value))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_add_get_args with %s:%s. msg: %s",
-            ngx.ctx.request_id, header_name, header_value, msg))
+        nlog(err_fmt("failed to invoke coraza_add_get_args with %s:%s. msg: %s",
+                      header_name, header_value, msg))
     end
 end
 
@@ -214,11 +212,9 @@ function _M.process_request_headers(transaction)
     -- extern int coraza_process_request_headers(coraza_transaction_t t);
     local ok, msg = pcall(coraza.coraza_process_request_headers, transaction)
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_process_request_headers",
-            ngx.ctx.request_id))
+        nlog(debug_fmt("success to invoke coraza_process_request_headers"))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_headers. msg: %s",
-            ngx.ctx.request_id, msg))
+        nlog(err_fmt("failed to invoke coraza_process_request_headers. msg: %s", msg))
     end
 end
 
@@ -233,11 +229,10 @@ function _M.intervention(transaction)
         if status_code == 0 then
             status_code = 403
         end
-        nlog(debug_fmt("Transaction %s disrupted with status %s action %s",
-                ngx.ctx.request_id, status_code, action))
+        nlog(debug_fmt("disrupted with status %s action %s", status_code, action))
         return action, status_code
     else
-        nlog(debug_fmt("Failed to disrupt transaction %s, action is nil", ngx.ctx.request_id))
+        nlog(debug_fmt("Failed to disrupt, action is nil"))
         return nil, nil
     end
 
@@ -247,11 +242,9 @@ function _M.free_transaction(transaction)
     -- extern int coraza_free_transaction(coraza_transaction_t t);
     local ok, msg = coraza.coraza_free_transaction(transaction)
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_free_transaction",
-                ngx.ctx.request_id))
+        nlog(debug_fmt("success to invoke coraza_free_transaction"))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_free_transaction. msg: %s",
-                ngx.ctx.request_id, msg))
+        nlog(err_fmt("failed to invoke coraza_free_transaction. msg: %s", msg))
     end
 end
 
@@ -260,11 +253,9 @@ function _M.append_request_body(transaction, body)
     local ok, msg = pcall(coraza.coraza_append_request_body, transaction, 
                          cast_to_c_char(body), #body)
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_append_request_body with %s",
-                    ngx.ctx.request_id, body))
+        nlog(debug_fmt("success to invoke coraza_append_request_body with %s", body))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_append_request_body with %s. msg: %s",
-                    ngx.ctx.request_id, body, msg))
+        nlog(err_fmt("failed to invoke coraza_append_request_body with %s. msg: %s", body, msg))
     end
 end
 
@@ -274,11 +265,9 @@ function _M.request_body_from_file(transaction, file_path)
     local ok, msg = pcall(coraza.coraza_request_body_from_file,
                           transaction, cast_to_c_char(file_path))
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_request_body_from_file with %s",
-                ngx.ctx.request_id, file_path))
+        nlog(debug_fmt("success to invoke coraza_request_body_from_file with %s", file_path))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_request_body_from_file with %s. msg: %s",
-                ngx.ctx.request_id, file_path, msg))
+        nlog(err_fmt("failed to invoke coraza_request_body_from_file with %s. msg: %s", file_path, msg))
     end
 end
 
@@ -286,11 +275,9 @@ function _M.process_request_body(transaction)
     -- extern int coraza_process_request_body(coraza_transaction_t t);
     local ok, msg = pcall(coraza.coraza_process_request_body, transaction)
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_process_request_body",
-                        ngx.ctx.request_id))
+        nlog(debug_fmt("success to invoke coraza_process_request_body"))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_body. msg: %s",
-                      ngx.ctx.request_id, msg))
+        nlog(err_fmt("failed to invoke coraza_process_request_body. msg: %s", msg))
     end
 end
 
@@ -300,11 +287,11 @@ function _M.process_response_headers(transaction, status_code, proto)
     local ok, msg = pcall(coraza.coraza_process_response_headers,transaction, 
                          tonumber(status_code), cast_to_c_char(proto))
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_process_response_headers with %s %s",
-                        ngx.ctx.request_id, status_code, proto))
+        nlog(debug_fmt("success to invoke coraza_process_response_headers with %s %s",
+                        status_code, proto))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_headers with %s %s",
-                      ngx.ctx.request_id, status_code, proto))
+        nlog(err_fmt("failed to invoke coraza_process_response_headers with %s %s, msg: %s",
+                      status_code, proto, msg))
     end
 end
 
@@ -313,11 +300,11 @@ function _M.add_response_header(transaction, header_name, header_value)
     --                                       int name_len, char* value, int value_len);
     local ok, msg = pcall(coraza.coraza_add_response_header, transaction, cast_to_c_char(header_name), #header_name, cast_to_c_char(header_value), #header_value)
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_add_response_header with %s:%s",
-                        ngx.ctx.request_id, header_name, header_value))
+        nlog(debug_fmt("success to invoke coraza_add_response_header with %s:%s",
+                        header_name, header_value))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_add_response_header with %s:%s. msg: %s",
-                      ngx.ctx.request_id, header_name, header_value, msg))
+        nlog(err_fmt("failed to invoke coraza_add_response_header with %s:%s. msg: %s",
+                     header_name, header_value, msg))
     end
 end
 
@@ -325,33 +312,18 @@ function _M.append_response_body(transaction, body)
     local ok, msg = pcall(coraza.coraza_append_response_body, transaction, 
                           cast_to_c_char(body), #body)
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_append_response_body with %s",
-                ngx.ctx.request_id, body))
+        nlog(debug_fmt("success to invoke coraza_append_response_body with %s", body))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_append_response_body with %s, msg: %s",
-                ngx.ctx.request_id, body, msg))
+        nlog(err_fmt("failed to invoke coraza_append_response_body with %s, msg: %s", body, msg))
     end
 end
 
 function _M.process_response_body(transaction)
     local ok, msg = pcall(coraza.coraza_process_response_body,transaction)
     if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_process_response_body",
-                ngx.ctx.request_id))
+        nlog(debug_fmt("success to invoke coraza_process_response_body"))
     else
-        nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_body. msg: %s",
-                ngx.ctx.request_id, msg))
-    end
-end
-
-function _M.process_logging(transaction)
-    local ok, msg = pcall(coraza.coraza_process_logging, transaction)
-    if ok then
-        nlog(debug_fmt("Transaction %s success to invoke coraza_process_logging",
-        ngx.ctx.request_id))
-    else 
-        nlog(debug_fmt("Transaction %s failed to invoke coraza_process_logging. msg: %s",
-                ngx.ctx.request_id, msg))
+        nlog(err_fmt("failed to invoke coraza_process_response_body. msg: %s", msg))
     end
 end
 
diff --git a/lib/resty/coraza/log.lua b/lib/resty/coraza/log.lua
index 98dc597..11813ef 100644
--- a/lib/resty/coraza/log.lua
+++ b/lib/resty/coraza/log.lua
@@ -15,9 +15,13 @@ local WARN = ngx.WARN
 local DEBUG = ngx.DEBUG
 
 local function log(formatstring, ...)
-    return fmt("PID: "..ngx.worker.pid()..
-              "\tphrase: "..ngx.get_phase()..
-              "\tlua-resty-coraza: "..formatstring, ...)
+    local str = "PID: "..ngx.worker.pid()..
+                "\tphrase: "..ngx.get_phase()
+    if ngx.ctx.request_id ~= nil then
+        str = str.."\tTransaction: "..ngx.ctx.request_id
+    end
+    str = str.."\tlua-resty-coraza: "..formatstring
+    return fmt(str, ...)
 end
 
 function _M.err_fmt(formatstring, ...)
diff --git a/lib/resty/coraza/request.lua b/lib/resty/coraza/request.lua
index 929e06d..c12a153 100644
--- a/lib/resty/coraza/request.lua
+++ b/lib/resty/coraza/request.lua
@@ -1,6 +1,9 @@
 local coraza = require "resty.coraza.coraza"
+local log = require "resty.coraza.log"
+
 
 local fmt = string.format
+local warn_fmt = log.warn_fmt
 
 local ngx = ngx
 local nlog = ngx.log
@@ -11,13 +14,21 @@ local _M = {
 
 
 function _M.build_and_process_header(transaction)
+    -- https://github.com/openresty/lua-nginx-module#ngxreqget_headers
     local headers, err = ngx.req.get_headers(0, true)
     if err then
         err = fmt("failed to call ngx.req.get_headers: %s", err)
         nlog(ngx.ERR, err)
     end
     for k, v in pairs(headers) do
-        coraza.add_request_header(transaction, k, v)
+        if type(v) == "table" then
+            nlog(warn_fmt("http request headers potentially has HPP!"))
+            for _, value in ipairs(v) do
+                coraza.add_request_header(transaction, k, value)
+            end
+        else 
+            coraza.add_request_header(transaction, k, v)
+        end
     end
     coraza.process_request_headers(transaction)
 end
@@ -39,7 +50,14 @@ function _M.build_and_process_get_args(transaction)
     -- process http get args if has
     local arg = ngx.req.get_uri_args()
     for k,v in pairs(arg) do
-        coraza.add_get_args(transaction, k, v)
+        if type(v) == "table" then
+            nlog(warn_fmt("http get args potentially has HPP!"))
+            for _, value in ipairs(v) do
+                coraza.add_get_args(transaction, k, value)
+            end
+        else
+            coraza.add_get_args(transaction, k, v)
+        end
     end
 end
 
diff --git a/lib/resty/coraza/response.lua b/lib/resty/coraza/response.lua
new file mode 100644
index 0000000..705c808
--- /dev/null
+++ b/lib/resty/coraza/response.lua
@@ -0,0 +1,60 @@
+local coraza = require "resty.coraza.coraza"
+local log = require "resty.coraza.log"
+
+local fmt = string.format
+local warn_fmt = log.warn_fmt
+
+local ngx = ngx
+local nlog = ngx.log
+
+local _M = {
+    _VERSION = '1.0.0',
+}
+
+function _M.clear_header_as_body_modified()
+    ngx.header.content_length = nil
+    -- in case of upstream content is compressed content
+    ngx.header.content_encoding = nil
+
+    -- clear cache identifier
+    ngx.header.last_modified = nil
+    ngx.header.etag = nil
+end
+
+function _M.build_and_process_body(transaction)
+    local chunk, eof = ngx.arg[1], ngx.arg[2]
+    if type(chunk) == "string" and chunk ~= "" then
+        -- TODO: 为了性能，客户端响应的二进制内容很有可能是下载或者加密等，
+        -- 目前不支持检测二进制响应
+        coraza.append_response_body(transaction, chunk)
+    end
+
+    if eof then
+        coraza.process_response_body(transaction)
+    end
+end
+
+-- process http req headers
+function _M.build_and_process_header(transaction)
+    local h = ngx.resp.get_headers(0, true)
+    for k, v in pairs(h) do
+        if type(v) == "table" then
+            nlog(warn_fmt("http response headers potentially has HPP!"))
+            for _, value in ipairs(v) do
+                coraza.add_response_header(transaction, k, value)
+            end
+        else
+            coraza.add_response_header(transaction, k, v)
+        end
+    end
+
+    local http_version = ngx.req.http_version()
+    if http_version == nil then
+        http_version = 1.1
+    end
+
+    http_version = fmt("HTTP/%.1f", http_version)
+    coraza.process_response_headers(transaction, ngx.status, http_version)
+end
+
+return _M
diff --git a/t/request.t b/t/request.t
new file mode 100644
index 0000000..f00ec1b
--- /dev/null
+++ b/t/request.t
@@ -0,0 +1,231 @@
+use Test::Nginx::Socket 'no_plan';
+
+our $HttpConfig = <<'_EOC_';
+    lua_package_path "lib/?.lua;/usr/local/share/lua/5.1/?.lua;;";
+    lua_socket_log_errors off;
+    lua_need_request_body on;
+_EOC_
+
+our $LocationConfig = <<'_EOC_';
+    location /t {
+        content_by_lua_block {
+            local coraza = require "resty.coraza"
+            local waf = coraza.create_waf()
+            if waf then
+                ngx.say("done")
+            end
+            
+        }
+    }
+_EOC_
+
+add_block_preprocessor(sub {
+    my ($block) = @_;
+
+    if (!defined $block->request) {
+        $block->set_value("request", "GET /t");
+    }
+});
+
+no_shuffle();
+no_long_string();
+no_root_location();
+run_tests();
+
+__DATA__
+
+=== TEST 1: sanity
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local request = require "resty.coraza.request"
+            if request then
+                ngx.say("done")
+            end
+        }
+    }
+--- error_code: 200
+--- response_body_like eval
+"done"
+
+=== TEST 2: build_and_process_header
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local request = require "resty.coraza.request"
+            local coraza = require "resty.coraza.coraza"
+            local waf = coraza.new_waf()
+            local tran = coraza.new_transaction(waf)
+            request.build_and_process_header(tran)
+            ngx.say("done")
+        }
+    }
+
+--- more_headers
+aaa: bbbb
+cc:dd
+cc:ee
+--- error_code: 200
+--- response_body_like eval
+"done"
+--- error_log eval
+[
+    "success to invoke coraza_add_request_header with aaa:bbbb",
+    "potentially has HPP",
+    "coraza_add_request_header with cc:dd",
+    "coraza_add_request_header with cc:ee"
+]
+
+=== TEST 3: build_and_process_body with simple body
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local request = require "resty.coraza.request"
+            local coraza = require "resty.coraza.coraza"
+            local waf = coraza.new_waf()
+            local tran = coraza.new_transaction(waf)
+            request.build_and_process_body(tran)
+            ngx.say("done")
+        }
+    }
+--- request
+POST /t
+aaa=bbb
+--- error_code: 200
+--- response_body_like eval
+"done"
+--- error_log eval
+[
+    "success to invoke coraza_append_request_body with aaa=bbb", 
+    "success to invoke coraza_process_request_body"
+]
+
+=== TEST 4: build_and_process_body with Json body
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local request = require "resty.coraza.request"
+            local coraza = require "resty.coraza.coraza"
+            local waf = coraza.new_waf()
+            local tran = coraza.new_transaction(waf)
+            request.build_and_process_body(tran)
+            ngx.say("done")
+        }
+    }
+
+--- more_headers
+content-type: application/json
+--- request
+POST /t
+[{
+	"msg": "Blocked User-Agent",
+	"data": "User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.44",
+}]
+--- error_code: 200
+--- response_body_like eval
+"done"
+--- error_log eval
+[
+    "Blocked User-Agent", 
+    "User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7",
+    "success to invoke coraza_process_request_body"
+]
+
+=== TEST 5: build_and_process_body with multipart-formdata
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local request = require "resty.coraza.request"
+            local coraza = require "resty.coraza.coraza"
+            local waf = coraza.new_waf()
+            local tran = coraza.new_transaction(waf)
+            request.build_and_process_body(tran)
+            ngx.say("done")
+        }
+    }
+
+--- more_headers
+Content-Type: multipart/form-data; boundary=boundary1234567890
+--- request
+POST /t/upload
+--boundary1234567890
+Content-Disposition: form-data; name="username"
+
+John Doe
+--boundary1234567890
+Content-Disposition: form-data; name="profile_pic"; filename="pic.jpg"
+Content-Type: image/jpeg
+
+[Binary data goes here]
+--boundary1234567890
+Content-Disposition: form-data; name="email"
+
+john.doe@example.com
+--boundary1234567890--
+--- error_code: 200
+--- response_body_like eval
+"done"
+--- error_log eval
+[
+    "success to invoke coraza_append_request_body with --boundary1234567890",
+    "--boundary1234567890",
+    "success to invoke coraza_process_request_body"
+]
+
+=== TEST 6: build_and_process_body with none body
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local request = require "resty.coraza.request"
+            local coraza = require "resty.coraza.coraza"
+            local waf = coraza.new_waf()
+            local tran = coraza.new_transaction(waf)
+            request.build_and_process_body(tran)
+            ngx.say("done")
+        }
+    }
+
+--- request
+POST /t/upload
+--- error_code: 200
+--- response_body_like eval
+"done"
+--- error_log eval
+[
+    "success to invoke coraza_process_request_body"
+]
+
+=== TEST 7: build_and_process_get_args
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local request = require "resty.coraza.request"
+            local coraza = require "resty.coraza.coraza"
+            local waf = coraza.new_waf()
+            local tran = coraza.new_transaction(waf)
+            request.build_and_process_get_args(tran)
+            ngx.say("done")
+        }
+    }
+
+--- request
+POST /t/upload?aaa=bbb&ccc=ddd&eee=fff&eee=ggg
+--- error_code: 200
+--- response_body_like eval
+"done"
+--- error_log eval
+[
+    "success to invoke coraza_add_get_args with aaa:bbb",
+    "http get args potentially has HPP!",
+    "with eee:fff",
+    "with eee:ggg",
+    "with ccc:ddd"
+]
+
diff --git a/t/response.t b/t/response.t
new file mode 100644
index 0000000..90967c3
--- /dev/null
+++ b/t/response.t
@@ -0,0 +1,142 @@
+use Test::Nginx::Socket 'no_plan';
+
+our $HttpConfig = <<'_EOC_';
+    lua_package_path "lib/?.lua;/usr/local/share/lua/5.1/?.lua;;";
+    lua_socket_log_errors off;
+    lua_need_request_body on;
+_EOC_
+
+our $LocationConfig = <<'_EOC_';
+    location /t {
+        content_by_lua_block {
+            local coraza = require "resty.coraza"
+            local waf = coraza.create_waf()
+            if waf then
+                ngx.say("done")
+            end
+            
+        }
+    }
+_EOC_
+
+add_block_preprocessor(sub {
+    my ($block) = @_;
+
+    if (!defined $block->request) {
+        $block->set_value("request", "GET /t");
+    }
+});
+
+no_shuffle();
+no_long_string();
+no_root_location();
+run_tests();
+
+__DATA__
+
+=== TEST 1: sanity
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local coraza = require "resty.coraza.response"
+            if coraza then
+                ngx.say("done")
+            end
+        }
+    }
+--- error_code: 200
+--- response_body_like eval
+"done"
+
+=== TEST 2: clear_header_as_body_modified
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local coraza = require "resty.coraza.response"
+            coraza.clear_header_as_body_modified()
+            ngx.say("done")
+        }
+    }
+--- error_code: 200
+--- response_body_like eval
+"done"
+
+=== TEST 3: build_and_process_body
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local coraza = require "resty.coraza.coraza"
+            local waf = coraza.new_waf()
+            local tran = coraza.new_transaction(waf)
+            ngx.ctx.tran = tran
+            ngx.say("aaaaaaaaaaaaaaaaaaaa")
+            ngx.say("bbbbbbbbbbbbbbbbbbbb")
+        }
+
+        body_filter_by_lua_block {
+            local response = require "resty.coraza.response"
+            response.build_and_process_body(ngx.ctx.tran)
+        }
+    }
+--- error_code: 200
+--- error_log eval
+["success to invoke coraza_append_response_body with aaaaaaaaaaaaaaaaaaaa",
+"success to invoke coraza_append_response_body with bbbbbbbbbbbbbbbbbbbb",
+"success to invoke coraza_process_response_body"]
+
+=== TEST 4: build_and_process_header
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local coraza = require "resty.coraza.coraza"
+            local waf = coraza.new_waf()
+            local tran = coraza.new_transaction(waf)
+            ngx.ctx.tran = tran
+            ngx.header.aa="bb"
+            ngx.header.cc={"dd", "ee"}
+        }
+
+        body_filter_by_lua_block {
+            local response = require "resty.coraza.response"
+            response.build_and_process_header(ngx.ctx.tran)
+        }
+    }
+--- error_code: 200
+--- response_headers
+aa:bb
+cc:dd, ee
+--- error_log eval
+["success to invoke coraza_add_response_header with aa:bb",
+"with cc:dd", "with cc:ee"]
+
+=== TEST 5: build_and_process_header with http 0.9
+--- http_config eval: $::HttpConfig
+--- config     
+location /t {
+        content_by_lua_block {
+            local coraza = require "resty.coraza.coraza"
+            local waf = coraza.new_waf()
+            local tran = coraza.new_transaction(waf)
+            ngx.ctx.tran = tran
+            ngx.header.aa="bb"
+            ngx.header.cc={"dd", "ee"}
+        }
+
+        body_filter_by_lua_block {
+            local response = require "resty.coraza.response"
+            response.build_and_process_header(ngx.ctx.tran)
+        }
+    }
+
+--- request
+GET /t  HTTP/1.0
+--- error_code: 200
+--- response_headers
+aa:bb
+cc:dd, ee
+--- error_log eval
+["coraza_process_response_headers with 200 HTTP/1.0"]
\ No newline at end of file
diff --git a/t/sanity.t b/t/sanity.t
index b31a0ec..193a509 100644
--- a/t/sanity.t
+++ b/t/sanity.t
@@ -123,7 +123,7 @@ location /t {
     }
 --- error_code: 200
 --- error_log eval
-["Success to creat new transaction id"]
+["Success to creat new transaction"]
 
 === TEST 7: test new_transaction with nil waf pointer
 --- http_config eval: $::HttpConfig
@@ -137,7 +137,7 @@ location /t {
     }
 --- error_code: 200
 --- error_log eval
-["Failed to creat new transaction id"]
+["Failed to creat new transaction"]
 
 === TEST 8: test process_connection
 --- http_config eval: $::HttpConfig