Suricata evasion, starring URL decoding

This post explains how Suricata normalizes and decodes HTTP data, highlighting that http.uri performs RFC 3986 percent-decoding but not '+' to space conversion, and that http.request_body is not decoded by default—even for application/x-www-form-urlencoded data. It demonstrates how these behaviors enable detection bypasses (e.g., using '+' or encoded payloads) and advises using the url_decode modifier where needed, carefully choosing between http.uri and http.uri.raw to avoid double-decoding and normalization pitfalls.