Bot Demo 1: Forced Timeout

Demo 1

🎯 Demo Purpose

Demonstrates how bot traffic detected by AWS WAF Bot Control is silently routed by a CloudFront Function to an unreachable origin, inducing a 30-second timeout. The bot wastes resources while believing the site is slow, not that it was detected.

🔧 How It Works

1

Bot Detection

AWS WAF Bot Control (TARGETED) analyzes request signals — automated browser patterns, JA4 fingerprint, etc. — and attaches a targeted label.

2

Header Forwarding

WAF rule P7 ForwardBotSignals converts label values to the x-amzn-waf-bot-targeted header via dynamic label interpolation.

3

CloudFront Function Routing

The CloudFront Function checks x-amzn-waf-bot-targeted and switches to the timeout origin with 70% probability using cf.selectRequestOriginById('timeout-alb').

4

Timeout Induced

The request is routed to an unreachable ALB and hangs for 30 seconds. The bot perceives a slow site, not a block — ensuring it does not adapt its strategy.

⚙️ Technical Details

AWS WAF Bot Control

TARGETED inspection level, ML-based bot detection and classification

CloudFront Function

Lightweight JavaScript executed at viewer-request. Uses selectRequestOriginById() because updateRequestOrigin() is unsupported on VPC origin behaviors.

VPC Origin

Private-subnet ALB connected as a CloudFront VPC origin (normal traffic path)

Timeout ALB

ALB with no reachable targets. readTimeout=30s, connectionTimeout=10s.

🚀 Run the Demo

A regular browser reaches the page instantly. An automated bot (e.g. Puppeteer) will receive the targeted label after a few requests and experience ~70% timeouts.

Run Demo 1

⚠️ Notes

  • Requests classified as bots may experience up to a 30-second load delay.
  • Regular browser users are not affected.
  • 30% of the time bots receive a normal response, preventing them from detecting the evasion.