In short. AWS WAF can challenge repeated missing token requests through targeted Bot Control's aggregate rule.
Definition: AWS WAF can challenge a request with no valid token because the targeted Bot Control rule group includes a Challenge action for an aggregate missing-token condition. The individual missing-token rule uses Count, while the aggregate rule challenges a client after repeated requests without an accepted token.
Key facts
- AWS documents
TGT_TokenAbsentas inspecting unverified-bot requests without a valid challenge token and using the Count action in the Bot Control managed rule reference. - The targeted protection level challenges clients after five requests without an accepted token label, and AWS says it does not block an individual request with no valid token in its token blocking guidance.
- For a Challenge action, AWS WAF stops web ACL evaluation when the token is missing, invalid, or expired, according to CAPTCHA and Challenge action behavior.
- AWS WAF uses an encrypted token carried by the client and verifies its contents, as described in Token use in AWS WAF intelligent threat mitigation.
Which targeted rule causes the challenge?
Targeted Bot Control rules are the rules whose names begin with TGT_. AWS describes this protection level as adding detection for sophisticated bots that do not self identify and as combining rate limiting with CAPTCHA and background browser challenges.
The direct missing-token rule is TGT_TokenAbsent. It inspects requests from bots that AWS has not verified when they lack a valid challenge token. Its documented action is Count, and it adds the label awswaf:managed:aws:bot-control:TGT_TokenAbsent.
The challenge comes from TGT_VolumetricIpTokenAbsent. It examines unverified-bot traffic with 5 or more requests from one client during the last 5 minutes when those requests do not include a valid challenge token. Its action is Challenge. AWS also says that the rule counts missing-token requests for each client IP, so a later request can match even when that request contains a token if the same client recently exceeded the missing-token condition.
TGT_TokenAbsent: Count
TGT_VolumetricIpTokenAbsent: Challenge
What does the Challenge action do with an absent token?
AWS explains that a Challenge or CAPTCHA rule first checks the token state and the configured immunity time. A valid token is handled similarly to Count, after which evaluation continues. A missing, invalid, or expired token stops web ACL evaluation and prevents the request from reaching its intended destination.
For the Challenge response, AWS documents the x-amzn-waf-action header with the value challenge and HTTP status 202 Request Accepted. When the request accepts HTML, the response includes a JavaScript interstitial with a challenge script. After a successful challenge, the interstitial initializes a token if the client has none, then updates it with the challenge solve timestamp.
x-amzn-waf-action: challenge
HTTP status: 202 Request Accepted
The result is therefore a challenge response for the request that triggered the aggregate rule. The rule does not require an already valid token before it can issue the Challenge action; the action is the mechanism that asks the client to obtain or refresh one.
Which other targeted rules inspect tokens?
The managed rule reference also lists token-based signals and reuse checks. TGT_VolumetricSession and TGT_VolumetricSessionMaximum inspect session volume when a request has a token; their documented actions are CAPTCHA and Block. TGT_SignalAutomatedBrowser, TGT_SignalBrowserAutomationExtension, and TGT_SignalBrowserInconsistency inspect token or browser data and use CAPTCHA.
The token-reuse rules examine one token across locations during the last 5 minutes. The IP, country, and ASN families each use the same action pattern: Low uses Count, Medium uses CAPTCHA, and High uses Block. The reference gives distinct thresholds for each family, including more than 2, 5, and 8 IPs for the IP family, more than 1, 2, and 3 countries for the country family, and more than 1, 2, and 3 ASNs for the ASN family.
How can a website block a missing-token request?
AWS says the targeted Bot Control level challenges after the repeated-request condition and allows a request without a valid token to exit the managed rule group evaluation. A separate rule can run immediately after the managed group and match the token label awswaf:managed:token:absent; AWS’s example uses a LabelMatchStatement and a Block action. This makes the missing-token policy a separate web ACL rule rather than an assumption about the TGT_TokenAbsent Count action.
Related terms
- How do AWS WAF Bot Control inspection levels differ?
- How do AWS WAF Bot Control rules treat verified bots?
- Can AWS WAF's targeted bot machine learning rules be turned off separately?
- When can a later AWS WAF rule match a label added by another rule?
FAQ
Does every missing-token request receive a challenge?
No. AWS documents TGT_TokenAbsent with the Count action. The targeted protection level applies Challenge through TGT_VolumetricIpTokenAbsent after the documented repeated-request condition.
What happens after you solve the challenge?
After you respond successfully, the challenge interstitial initializes a token when you do not already have one and updates it with the challenge solve timestamp. A later request can then present that token for AWS WAF to verify.
Can you block missing-token requests immediately?
Yes. AWS documents a separate rule placed after the managed rule group that matches awswaf:managed:token:absent and uses Block. The example narrows the rule to the protected endpoint and method.
Sources
- AWS, "AWS WAF Bot Control rule group", undated
- AWS, "Blocking requests that don't have a valid AWS WAF token", undated
- AWS, "CAPTCHA and Challenge action behavior", undated
- AWS, "Token use in AWS WAF intelligent threat mitigation", undated
Check how a page reads to answer engines. Open the GEO score analyzer