In my Spring MVC 3 application, I am following REST patterns and lots of logic is based on HTTP status code. For instance 500 defines a server error.

  But OWASP modsecurity says not to expose this status code as per -

https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/master/base_rules/modsecurity_crs_50_outbound.conf

I don't understand why a 500 status code would be bad  ?

I see even Google showcases 500 properly https://i.sstatic.net/E0awT.png

In my Spring MVC 3 application, I am following REST patterns and lots of logic is based on HTTP status codes. For instance 500 defines a server error. But OWASP modsecurity says not to expose this status code.

I don't understand why a 500 status code would be bad? I see even Google showcases 500 properly.