Request settings
WAF attestation — token / challenge.js
Loading WAF SDK config…
Uncheck to send plain fetch() like curl. Saved in localStorage.
WAF CAPTCHA — interactive puzzle
Renders the AWS WAF CAPTCHA widget via AwsWafCaptcha.renderCaptcha().
On success the token is updated; use section 4 to call a protected API.
E2E invite flow — Lambda@Edge + mTLS
Full path through edge proxy to real invite lambdas. CSRF token is legacy; mTLS host bypasses CSRF authorizer.
Negative tests — WAF enforce
Always uses plain fetch() without WAF token. Expect HTTP 403 when ATTESTATION_ENFORCE=true.