Bot Prevention

Flumotion Smart Multi CDN Bot Prevention provides intelligent protection against automated bot traffic, helping ensure that only legitimate human users can access your content and APIs.

This security mechanism is configured once and integrated seamlessly across your CDN providers.

Overview #

Bot Prevention can:

• Protect access to specific web pages without requiring changes to your application.
• Protect specific page actions or API requests, which requires integration with your frontend code.

When a request matches the configured rule parameters, the CDN validates that the client is not a bot before allowing access to the requested resource.

This challenge-response mechanism takes place transparently at the edge, protecting your Origin servers and intellectual property from bot traffic while minimizing the impact on legitimate users.

Protecting an entire page is straightforward and requires no integration with your application. However, whenever the page is loaded for the first time during a user’s session, the interaction is checked for bot activity.

Protecting a specific page action requires additional integration. For example, if a page displays a shopping cart, you may want to protect only the action triggered by pressing the Buy button rather than protecting the entire page.

The default behavior attempts to perform validation without requiring user interaction. In most cases, the request is automatically forwarded to the Origin after the system validates that the user is not a bot, which typically takes only a short time.

You can adjust this behavior for each rule, ranging from fully interactive, where users are always required to complete a challenge, to non-interactive validation, where users may be given an additional opportunity to prove that they are human.

The default challenge behavior provides a balance between minimizing interruptions to legitimate users and maintaining effective protection against automated traffic.

Bot Prevention can be applied through:

• Custom Rules – Apply bot detection to specific traffic patterns or endpoints.
• Rate Limiting Rules – Combine bot validation with Rate Limiting for enhanced protection.

Protecting Entire Pages #

How It Works #

When Bot Prevention is enabled for a web page:

• The WAF engine evaluates incoming requests against the configured rule parameters. For example, URL Path is /login.html and the configured action is CHALLENGE.
• Requests matching the criteria trigger a bot validation challenge.
• Typically, validation takes only a short time and does not require client interaction.
• If the validation result is below a pre-configured threshold, the WAF engine presents the client with an interactive puzzle.
• The client must successfully complete the validation to prove that it is a legitimate browser.
• Once validated, either silently or through an interactive puzzle, the request is allowed to proceed.
• Failed validation attempts are blocked at the edge.

This approach provides protection against various types of automated threats, including scrapers, credential stuffing attacks, and DDoS attempts, while maintaining a smooth experience for legitimate users.

If additional protection is required, you can set the rule action to INTERACTIVE-CHALLENGE, which always presents the client with an interactive puzzle.

Configuring Bot Prevention #

Create a Custom Rule or Rate Limiting Rule:

1. Navigate to SECURITY > WAF and select the Custom Rules tab, or navigate to SECURITY > RATE LIMITING.
2. Click CREATE to open the Create Custom Rule dialog.
3. Define the parameters that determine when the rule is triggered.
4. Select CHALLENGE or INTERACTIVE-CHALLENGE as the action.

Monitoring Bot Prevention #

Bot challenge activity can be monitored from the Security Analytics page:

• The Challenge Invoked value indicates how many page requests triggered Bot Prevention.
• Add a filter on Action to view challenge invocations over time. You can do this from the Action top table.

Protecting Page Actions / API Requests #

How It Works #

To protect a specific page action, you need to:

• Integrate the Flumotion Smart Multi CDN Bot Prevention JavaScript code into your frontend page.
• Add headers containing the identity of the action you want to protect, such as a Buy action, and a key that identifies your service as an additional security measure.
• Create a Custom Rule or Rate Limiting Rule that activates the Bot Prevention challenge when the relevant API request is called.

Adding Bot Prevention Code to Your Frontend Page #

Add the following code to your page HTML <head>:

<script src="https://challenge.ioriver.io/challenge/v0/api.js?webSiteKey=:webKey:"></script>

Alternatively, add the following code, or equivalent, to your application:

const script = document.createElement("script");
script.src = "https://challenge.ioriver.io/challenge/v0/api.js?webSiteKey=:webKey:";
document.head.prepend(script);

Replace webKey with the Key ID for your service, which you can find in the Flumotion Smart Multi CDN console under SECURITY > BOT MANAGEMENT.

Add a call to iorbot.execute to create a token containing the bot score, and then add two headers to your API request:

• The token as the X-IOR-ACTION-TOKEN header.
• The action name as the X-IOR-ACTION header.

For example, if your code calls your API as follows:

let resp = await fetch('/api/...', { method: 'POST' });
...

Replace it with:

let token = await window.iorbot.execute(':action:');

let resp = await fetch('/api/...', {
    method: 'POST',
    headers: {
        'X-IOR-ACTION-TOKEN': token,
        'X-IOR-ACTION': ':action:'
    }
});
...

Creating a Custom Rule #

Create a Custom Rule or Rate Limiting Rule:

1. Navigate to SECURITY > WAF and select the Custom Rules tab, or navigate to SECURITY > RATE LIMITING.
2. Click CREATE to open the Create Custom Rule dialog.
3. Define the conditions that determine when Bot Prevention should be applied:

• Define a condition that identifies the action, typically based on the URL Path. For example, URL Path begins with /api/buy/.
• Define a condition for the minimum bot score, typically Action Token Score greater than 0.5, and provide the :action: name as defined in your code.

4. Select BLOCK as the action.

Monitoring Bot Prevention #

Bot challenge activity can be monitored from the Security Analytics page:

• Add a filter on Action to view challenge invocations over time. You can do this from the Action top table.