Conditional challenges

Apply verification to selected traffic instead of the host-wide settings in JavaScript challenge and CAPTCHA verification. A policy rule can select a sensitive path; an event-driven mitigation selects traffic during an attack.

The human-verification option is a CAPTCHA, short for “Completely Automated Public Turing test to tell Computers and Humans Apart.”

Application-layer distributed denial-of-service (DDoS) mitigation can also select JavaScript verification during an event.

Alternative	Selector	Status and comparison
Policy JavaScript	Exact /policy-js rule	JavaScript is verified; / bypasses verification.
Policy CAPTCHA	Exact /policy-captcha rule	Completion un-verified; / should bypass verification.
DDoS JavaScript	Active application-layer mitigation	un-verified; deferred. Compare normal traffic outside the event.

See response-body encoding to create your own message. Keep the JavaScript verification script or CAPTCHA controls usable when customizing a challenge message.

Policy-selected JavaScript challenge

Visitor message: Please wait while your browser is verified.

policy_based_challenge.js_challenge_parameters supplies the page and parameters. A rule matching exactly /policy-js selects enable_javascript_challenge; no_challenge is the default. A valid verification cookie can let a returning visitor continue without repeating the challenge.

Shared policy source

{
  "spec": {
    "policy_based_challenge": {
      "js_challenge_parameters": {
        "cookie_expiry": 300,
        "custom_page": "string:///PHA+UGxlYXNlIHdhaXQgd2hpbGUgeW91ciBicm93c2VyIGlzIHZlcmlmaWVkLjwvcD4=",
        "js_script_delay": 1000
      },
      "no_challenge": {},
      "rule_list": {
        "rules": [
          {
            "metadata": {
              "name": "challenge-js-path"
            },
            "spec": {
              "any_client": {},
              "any_ip": {},
              "any_asn": {},
              "path": {
                "exact_values": [
                  "/policy-js"
                ]
              },
              "enable_javascript_challenge": {}
            }
          },
          {
            "metadata": {
              "name": "challenge-captcha-path"
            },
            "spec": {
              "any_client": {},
              "any_ip": {},
              "any_asn": {},
              "path": {
                "exact_values": [
                  "/policy-captcha"
                ]
              },
              "enable_captcha_challenge": {}
            }
          }
        ]
      },
      "captcha_challenge_parameters": {
        "cookie_expiry": 300,
        "custom_page": "string:///PHA+UGxlYXNlIGNvbXBsZXRlIHRoZSB2ZXJpZmljYXRpb24gdG8gY29udGludWUuPC9wPg=="
      }
    }
  }
}

Decoded preview (escaped):

<p>Please wait while your browser is verified.</p>

Expected result: A fresh visit to /policy-js shows the selected message and working browser check; completion reaches the application. / bypasses the challenge, and the policy rule matches the challenged request.

Verified live example: Open the policy JavaScript challenge. Fresh Chrome completed verification; the unrelated root path reached the origin directly.

Policy-selected CAPTCHA

Status: completion un-verified. Selection and successful human completion must be confirmed independently; the qualified policy JavaScript result does not qualify this alternative.

Visitor message: Please complete the verification to continue.

policy_based_challenge.captcha_challenge_parameters supplies the page and cookie lifetime. An exact /policy-captcha rule selects enable_captcha_challenge, with no_challenge as the default.

The shared policy source above contains this rule alongside the JavaScript rule.

Decoded preview (escaped):

<p>Please complete the verification to continue.</p>

Expected result (un-verified): A fresh visit to /policy-captcha shows a usable CAPTCHA; completion reaches the application. / bypasses the challenge. Confirm the CAPTCHA policy rule selected the request.

DDoS-selected JavaScript challenge

Status: un-verified. DDoS testing is deferred. The configuration below documents the intended response; it has not been verified during a live mitigation event.

Visitor message: Please wait while your browser is verified.

l7_ddos_action_js_challenge supplies the message and parameters used when application-layer DDoS mitigation selects this action. Requesting /challenge alone does not activate mitigation.

DDoS JavaScript source

{
  "spec": {
    "l7_ddos_action_js_challenge": {
      "cookie_expiry": 300,
      "custom_page": "string:///PHA+UGxlYXNlIHdhaXQgd2hpbGUgeW91ciBicm93c2VyIGlzIHZlcmlmaWVkLjwvcD4=",
      "js_script_delay": 1000
    }
  }
}

Decoded preview (escaped):

<p>Please wait while your browser is verified.</p>

Expected result: During an authorized mitigation exercise, confirm that the mitigation event selected the challenge and that visitors can complete it. Compare normal traffic outside the event; custom wording alone does not prove mitigation activated.