Lambda@Edge mTLS POC — User Invite

Request settings

x-requesting-for (consumer) x-poc-origin (registered CSRF origin) Email (verify / invite)

WAF attestation — token / challenge.js

Loading WAF SDK config…

Use AwsWafIntegration.fetch() on API calls (silent challenge + token; same-origin uses aws-waf-token cookie)

Uncheck to send plain fetch() like curl. Saved in localStorage.

WAF CAPTCHA — interactive puzzle

Renders the AWS WAF CAPTCHA widget via AwsWafCaptcha.renderCaptcha(). On success the token is updated; use section 4 to call a protected API.

E2E invite flow — Lambda@Edge + mTLS

Full path through edge proxy to real invite lambdas. CSRF token is legacy; mTLS host bypasses CSRF authorizer.

Negative tests — WAF enforce

Clears aws-waf-token cookie, then plain fetch() with credentials: omit (same as clean curl). Expect HTTP 403 when ATTESTATION_ENFORCE=true; HTTP 200 in default COUNT mode. Use “Force token refresh” before section 4 if the next attested call fails.