JavaScript Challenge is Enabled in Application Gateway WAF

Overview

Azure Application Gateway Web Application Firewall (WAF) supports JavaScript challenge as a defense mechanism against automated bots and headless browsers. JavaScript challenge works by serving a small JavaScript snippet that must be executed by the client browser to prove that the request originates from a real browser capable of running JavaScript, rather than a simple HTTP client or bot.

When a request triggers a JavaScript challenge, the WAF responds with a challenge page containing JavaScript code that the browser must execute to obtain a valid challenge cookie. If the client successfully executes the JavaScript and returns with a valid cookie, subsequent requests proceed normally until the cookie expires. Bots and automated tools that cannot execute JavaScript fail this challenge and are blocked from accessing protected resources. This mechanism is particularly effective against credential stuffing bots, web scrapers, and distributed denial of service bots that use simple HTTP libraries without JavaScript engines.

The jsChallengeCookieExpirationInMins setting controls how long the challenge cookie remains valid before the client must complete another challenge. JavaScript challenge provides a middle ground between allowing all traffic and blocking suspected bots outright—it verifies browser capability without requiring user interaction like CAPTCHA. By configuring custom rules with JavaScript challenge action, organizations can protect sensitive endpoints like login pages, API endpoints, and high-value resources from automated abuse while maintaining a seamless experience for legitimate users.

Remediation

• What is Azure Web Application Firewall on Azure Application Gateway? - Overview of WAF capabilities on Application Gateway including custom rules and actions
• Create and use Web Application Firewall v2 custom rules on Application Gateway - Step-by-step guidance on creating custom rules with different actions including JavaScript challenge
• Web Application Firewall custom rules - Detailed documentation of custom rule types and available actions
• Bot protection overview for Application Gateway WAF - Overview of bot protection capabilities including challenge actions

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Azure Network Security
Product	Azure
Feature	Network security
Area	Infrastructure hardening
ATT&CK	T1110.004 Credential Stuffing, T1499.003 Application Exhaustion Flood
Licence	Azure WAF
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.