AWS WAF announces Web Bot Auth support

AWS WAF Web Bot Auth Support

Today, AWS WAF has introduced Web Bot Auth (WBA) support, offering a secure and standardized method to authenticate legitimate AI agents and automated tools accessing web applications. This new capability helps distinguish trusted bot traffic from potentially harmful automated access attempts.

Web Bot Auth is an authentication method that uses cryptographic signatures in HTTP messages to verify that a request comes from an automated bot. It relies on two active IETF drafts: a directory draft allowing the crawler to share their public keys, and a protocol draft defining how these keys should be used to attach crawler's identity to HTTP requests.

Verified WBA bots will now be automatically allowed by default, previously Category AI blocked unverified bots, this behavior is now refined to respect WBA verification.

What to do

• Review the documentation for more information.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.