Back to feed
Dev.to
Dev.to
7/23/2026
Detect in the Application, Block at the Edge: A Feedback Loop with AWS WAF and CloudFront KVS

Detect in the Application, Block at the Edge: A Feedback Loop with AWS WAF and CloudFront KVS

Short summary

A detailed technical article on building a feedback loop where the application detects malicious behavior and the edge (AWS WAF + CloudFront KVS) blocks it. The architecture uses WAF Dynamic Label Interpolation, JA4 fingerprinting, and CloudFront KeyValueStore to create a fail2ban-at-the-edge pattern. Includes production code samples for registering fingerprints and routing logic in CloudFront Functions.

  • •Application detects malicious behavior using context (failed logins, abnormal navigation) and registers fingerprints in CloudFront KVS
  • •Edge (CloudFront Functions + WAF) blocks or challenges flagged fingerprints before requests reach origin
  • •Includes Node.js code for KVS updates with optimistic locking and CloudFront Functions routing logic

Generated with AI, which can make mistakes.

Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

Implementing a JA4H-Equivalent Fingerprint with Amazon CloudFront Functions to Mitigate Bot Traffic
Dev.to
Building a False-Positive-Resilient Challenge Architecture with AWS WAF Dynamic Label Interpolation
Dev.to
Mitigating Session Hijacking with JA4 Session Binding and AWS WAF Dynamic Label Interpolation
Dev.to
The original title is: "Edge vs. Endpoint Bot Blocking: A Developer's Guide to Cloudflare and Wordfence"
Dev.to