&gt; I would think that dealing with incorrect data should be handled by the application rather than nginx. If you want to expose your application via other means it means you don&#x27;t have to duplicate your validation logic. Think also about giving feedback about the incorrect POST-data, I think your application is better suited to provide that, as it can return a &lt;form&gt; with carefully placed messages for instance.<p>A good chunk of traffic is bot exploit traffic and rejecting that silently at the proxy level is a viable option [its basically what Cloudflare, among others, use OpenResty for].<p>Incorrect data should go to the application, malicious data should be dropped before it gets there if practical.