ModSecurity Handbook: Getting Started - Bad Request

Guiding Principles
There are four guiding principles on which ModSecurity is based, as follows:
Flexibility
I think that it’s fair to say that I built ModSecurity for myself: a security expert who
needs to intercept, analyze, and store HTTP traffic. I didn’t see much value in hardcoded
functionality, because real life is so complex that everyone needs to do things
just slightly differently. ModSecurity achieves flexibility by giving you a powerful rule
language, which allows you to do exactly what you need to, in combination with the
ability to apply rules only where you need to.
Passiveness
ModSecurity will take great care to never interact with a transaction unless you tell it
to. That is simply because I don’t trust tools, even the one I built, to make decisions for
me. That’s why ModSecurity will give you plenty of information, but ultimately leave
the decisions to you.
Predictability
There’s no such thing as a perfect tool, but a predictable one is the next best thing.
Armed with all the facts, you can understand ModSecurity’s weak points and work
around them.
Quality over quantity
Over the course of six years spent working on ModSecurity, we came up with many
ideas for what ModSecurity could do. We didn’t act on most of them. We kept them
for later. Why? Because we understood that we have limited resources available at our
disposal and that our minds (ideas) are far faster than our implementation abilities.
We chose to limit the available functionality, but do really well at what we decided to
keep in.
There are bits in ModSecurity that fall outside the scope of these four principles. For example,
ModSecurity can change the way Apache identifies itself to the outside world, confine the
Apache process within a jail, and even implement an elaborate scheme to deal with a onceinfamous
universal XSS vulnerability in Adobe Reader. Although it was I who added those
features, I now think that they detract from the main purpose of ModSecurity, which is a
reliable and predictable tool that allows for HTTP traffic inspection.
Deployment Options
ModSecurity supports two deployment options: embedded and reverse proxy deployment.
There is no one correct way to use them; choose an option based on what best suits your
circumstances. There are advantages and disadvantages to both options:
Guiding Principles 7