CAPTCHA and Challenge actions in the logs and metrics
The CAPTCHA and Challenge actions can be non-terminating, like Count, or terminating, like Block. The outcome depends on whether the request has a valid token with an unexpired timestamp for the action type.
-
Valid token – When the action finds a valid token and doesn't block the request, AWS WAF captures metrics and logs as follows:
-
Increments the metrics for either
CaptchaRequests
andRequestsWithValidCaptchaToken
orChallengeRequests
andRequestsWithValidChallengeToken
. -
Logs the match as a
nonTerminatingMatchingRules
entry with action of CAPTCHA or Challenge. The following listing shows the section of a log for this type of match with the CAPTCHA action."nonTerminatingMatchingRules": [ { "ruleId": "captcha-rule", "action": "CAPTCHA", "ruleMatchDetails": [], "captchaResponse": { "responseCode": 0, "solveTimestamp": 1632420429 } } ]
-
-
Missing, invalid, or expired token – When the action blocks the request due to a missing or invalid token, AWS WAF captures metrics and logs as follows:
-
Increments the metric for
CaptchaRequests
orChallengeRequests
. -
Logs the match as a
CaptchaResponse
entry with HTTP405
status code or as aChallengeResponse
entry with HTTP202
status code. The log indicates whether the request was missing the token or had an expired timestamp. The log also indicates whether AWS WAF sent a CAPTCHA interstitial page to the client or a silent challenge to the client browser. The following listing shows the sections of a log for this type of match with the CAPTCHA action."terminatingRuleId": "captcha-rule", "terminatingRuleType": "REGULAR", "action": "CAPTCHA", "terminatingRuleMatchDetails": [], ... "responseCodeSent": 405, ... "captchaResponse": { "responseCode": 405, "solveTimestamp": 0, "failureReason": "TOKEN_MISSING" }
-
For information about the AWS WAF logs, see Logging AWS WAF web ACL traffic.
For information about AWS WAF metrics, see AWS WAF metrics and dimensions.
For information about rule action options, see Rule action.