AWS WAF

AWS WAF shows up as a browser challenge that mints an aws-waf-token cookie, and sometimes as an image-grid puzzle. Use the challenge task for the cookie, and the classification task for the grid.

Challenge vs. grid

The challenge task runs the AWS WAF browser check and returns an aws-waf-token cookie you attach to subsequent requests. When the site ships the SDK build, pass awsApiJs (the jsapi.js URL) so the right challenge.js is resolved from the same directory. The classification task is separate: it takes the nine grid tiles and a prompt and returns which tiles match, solved inline by ML.

AWS WAF Challenge

proxy optional

Clears the AWS WAF challenge and returns an aws-waf-token cookie. Use the proxy variant (proxyType/proxyAddress/proxyPort) when the token is IP-bound.

type (proxyless / proxy)

AntiAwsWafTaskProxyLessAntiAwsWafTask

Task parameters

websiteURL*The protected URL you want to reach.

awsApiJsThe jsapi.js SDK URL, when the site loads the SDK build. We use it to resolve challenge.js from the same directory.

Returns

the aws-waf-token cookie. Attach it to your follow-up requests.

If the page loads the AWS WAF SDK (jsapi.js) rather than the inline challenge, pass awsApiJs so the correct challenge.js is fetched from the same host and directory.

AWS WAF Grid Classification

Solves the AWS WAF image-grid puzzle. Send the nine tiles and the prompt, and receive the tiles that match. Solved inline by ML, no proxy needed.

type

AwsWafClassification

Task parameters

images*The nine grid tiles as base64 images.

question*The prompt, in aws:grid:<object> form (e.g. aws:grid:chair).

Returns

the indexes / coordinates of the matching tiles.

Send decoded tile images. Raw obfuscated tiles pulled straight from the widget will not classify.

Example

A challenge task body using the SDK URL:

aws-waf-task.json

{
  "clientKey": "capzy_YOUR_KEY",
  "task": {
    "type": "AntiAwsWafTaskProxyLess",
    "websiteURL": "https://example.com/",
    "awsApiJs": "https://xxxx.token.awswaf.com/xxxx/jsapi.js"
  }
}

Decode the tiles first

For the grid task, send the actual tile images as base64. If you forward the raw obfuscated tiles exactly as the widget delivers them, without decoding, they will not classify.

See Using proxies for the proxy fields, and Getting the result for the polling loop that returns solution.

DataDome

Bot managers