CAPTCHA and Challenge actions in the logs and metrics - Amazon WAF, Amazon Firewall Manager, and Amazon Shield Advanced
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

CAPTCHA and Challenge actions in the logs and metrics

This section explains how Amazon WAF handles logging and metrics for the CAPTCHA and Challenge actions.

The CAPTCHA and Challenge actions can be non-terminating, like Count, or terminating, like Block. The outcome depends on whether the request has a valid token with an unexpired timestamp for the action type.

  • Valid token – When the action finds a valid token and doesn't block the request, Amazon WAF captures metrics and logs as follows:

    • Increments the metrics for either CaptchaRequests and RequestsWithValidCaptchaToken or ChallengeRequests and RequestsWithValidChallengeToken.

    • Logs the match as a nonTerminatingMatchingRules entry with action of CAPTCHA or Challenge. The following listing shows the section of a log for this type of match with the CAPTCHA action.

          "nonTerminatingMatchingRules": [
    {
      "ruleId": "captcha-rule",
      "action": "CAPTCHA",
      "ruleMatchDetails": [],
      "captchaResponse": {
        "responseCode": 0,
        "solveTimestamp": 1632420429
      }
    }
  ]

  • Missing, invalid, or expired token – When the action blocks the request due to a missing or invalid token, Amazon WAF captures metrics and logs as follows:

    • Increments the metric for CaptchaRequests or ChallengeRequests.

    • Logs the match as a CaptchaResponse entry with HTTP 405 status code or as a ChallengeResponse entry with HTTP 202 status code. The log indicates whether the request was missing the token or had an expired timestamp. The log also indicates whether Amazon WAF sent a CAPTCHA interstitial page to the client or a silent challenge to the client browser. The following listing shows the sections of a log for this type of match with the CAPTCHA action.

          "terminatingRuleId": "captcha-rule",
    "terminatingRuleType": "REGULAR",
    "action": "CAPTCHA",
    "terminatingRuleMatchDetails": [],
    ...
    "responseCodeSent": 405,
    ...
    "captchaResponse": {
      "responseCode": 405,
      "solveTimestamp": 0,
      "failureReason": "TOKEN_MISSING"
    }

For information about the Amazon WAF logs, see Logging Amazon WAF web ACL traffic.

For information about Amazon WAF metrics, see Amazon WAF metrics and dimensions.

For general information about rule action options, see Using rule actions in Amazon WAF.

Requests with no token seem to show up twice in logs and metrics

Based on the CAPTCHA and Challenge action behavior and the logging and metrics described in this section, a request with no token will generally be represented twice in the logs and metrics. This is because the one intended request is actually sent twice by the client.

  • The first request, with no token, receives the logging and metrics handling described above for missing, invalid, or expired token. The CAPTCHA or Challenge action terminates this first request, and then responds back to the client with either a silent challenge or CAPTCHA puzzle.

  • The client evaluates the challenge or puzzle and, if the client browser or end user responds successfully, sends the request a second time with the newly acquired token. This second request receives the logging and metrics handling described above for a request with a valid token.