I did some research. The error is generated from a piece of code that does an IDS check. IDS stands for Intruder Detection System. It can be disabled in Drupal 7 by granting the skip IDS check to the anonymous user.
Now I have a workaround, but comment of the grants says this permission has security implications
What are exactly this security implications? Clients are always reluctant in disabling security stuff.
The work for IDS is done by the PHP package PHPIDS. It can be found on GitHub https://github.com/PHPIDS/PHPIDS. I could not find any documentation about how it works. The stats show me the following.
- The project is a bit old. Last commit in 2014.
- The project was also popular - 224 forks.
So maybe the IDS solves a problem from a long time ago and is not needed any more. Does someone (with a good memory) know the answers?