You're acting as the firewall, not the application. That was not one of the rules for the day. In the first place a waf is specifically to stop malicious requests hitting the app.
You're acting as the firewall, not the application. That was not one of the rules for the day. In the first place a waf is specifically to stop malicious requests hitting the app.
That's true but not an argument for 403 over 400. Certainly either works. But one is more correct.