Positive security model is a comprehensive security mechanism that provides an independent input validation envelope to an application. By defining rules for every parameter in every page in the application the application is protected by an additional security envelop independent from its code. For example, the following rules in ModSecurity rule language provide such comprehensive security to Exchange Outlook Web Access login page:

SecDefaultAction "log,deny,phase:2" <LocationMatch "^/exchweb/bin/auth/owaauth.dll$"> 	SecRule REQUEST_METHOD !POST 	SecRuleARGS:destination"!^....$" (full regular expression left out for simplicity) 	SecRule ARGS:flags "[0-9]{1,2}" 	SecRule ARGS:username "[0-9a-zA-Z]{,256}" 	SecRule ARGS:password ".{,256}" 	SecRule ARGS:SubmitCreds "!Log.On" 	SecRule ARGS:trusted "!(0|4)" </LocationMatch>