WAF JSON parser normalizes the body differently from the application and bypasses the intended block rule

Security rules appear present, but a crafted request still reaches the app because the protection layer interprets the JSON structure differently from the backend.