Why are dropdown fields submitted as base64?

[nstcactus]

I'm setting up a WAF for my Craft CMS 4 website and saving entries with a changed dropdown field triggers a security error because the field's POST data is encoded as base64.

Is there a reason for this? Why not passing the value in plain text just like other fields?

[brandonkelly]

We do this to ensure the option values won’t potentially resemble nested element IDs (see #11461).

[nstcactus]

So is it safe to create a rule for my WAF saying, if the value starts with base64:, consider it safe? Or do I have to manually create rules to allow each base64 encoded value all my options field may have?

[brandonkelly]

I would think that anything starting with base64: should be perfectly safe.