Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

AWS WAF Javascript API using `eval` and blocked by Content Security Policy (CSP)

0

We've noticed the AWS WAF Javascript challenge has started using inline evaluated Javascript code Or maybe it always has done and we're just picking up on it now in our reports? Our CSP strictly disallows eval in our script-src directive as it is poor practice. However we've started seeing browser reports showing a script at <random chars>.<region>.token.awswaf.com trying to inline evaluate some Javascript and it is being blocked. We've already allowed the *.awswaf.com domain in the CSP, but that would only cover scripts loaded from that domain, not eval processing. We are not going to enable eval for our site.

Is there any way to prevent WAF doing this in the JavaScript API? Can we raise a bug report to the WAF team to request that they load this functionality via a script from that domain instead? Alternatively is there anything we are doing incorrectly here that we could solve ourselves?

If anyone has any suggestions or has also seen this behaviour then please let us know.

Thanks!

Topics
Security, Identity, & ComplianceAWS Well-Architected Framework
Tags
AWS WAFSecurity
Language
English

asked a year ago356 views

2 Answers
6

I would suggest to:

  1. Raise a Feature Request or Bug Report Yes, you can and should raise this with AWS. The current behavior isn't CSP-friendly, and requesting that AWS load all functionality via external scripts (rather than inline eval) is a reasonable ask:
  • Submit feedback via your AWS Support plan
  • Open an issue on the Amazon EKS AMI GitHub repo if relevant

  1. Use SHA-based CSP Directives but Not Recommended Using script-src 'self' 'sha256-...' to allow specific inline scripts, but this is brittle and not recommended for dynamic scripts like those used by AWS WAF.

  2. Consider Alternative WAF Configurations If CSP compliance is critical, you might explore:

  • Using AWS WAF without JavaScript integrations (though this limits CAPTCHA and silent challenge features)
  • Implementing custom challenge logic that doesn’t rely on AWS’s JavaScript API
EXPERT

answered a year ago

  • Michael
    a year ago

    I appreciate your answer. I am hoping that AWS Support will also read this post as I am highly reluctant to pay hundreds of dollars to start a support plan just for the privilege of reporting a bug in their own system. I feel like bug reporting should not be part of a paid support plan, but what do I know?

    Thanks for your suggestions. I'll keep an eye on re:Post and see what else I can find.

0

Hey,

Hope you're keeping well.

The AWS WAF JavaScript challenge currently uses dynamic code evaluation as part of its bot mitigation flow, which will be blocked by a strict CSP without unsafe-eval. There’s no configuration to disable this in the managed challenge today. If you need to keep your CSP strict, the only path is to avoid using the JavaScript challenge and instead use other WAF rule actions like CAPTCHA or silent block. To request a CSP-friendly implementation, open a feature request through the AWS Support Center or your account team so it can be routed to the WAF service team.

Thanks and regards,
Taz

answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content