You're acting as the firewall, not the application. That was not one of the rules for the day. In the first place a waf is specifically to stop malicious requests hitting the app.