WAF JS Challenge Resource Test

PHP cURL engine request settings

This calls /waf-test/php-curl-engine.php, which sends the actual HTTP request from PHP to the selected /json-test/ target. This simulates non-JS clients.

No PHP cURL engine request yet.

No PHP cURL engine response yet.

No trace yet.

No headers yet.

No body yet.

Rule-testing intent

The control page is outside the protected path:
/waf-test/index.php

The test resources are inside the protected path:
/json-test/index.html
/json-test/app.js
/json-test/api-test.json
/json-test/data.json

If your WAF rule is broad, such as:
URL starts with /json-test/

then all of those resource types can match the rule.

That demonstrates why "Require JavaScript Support" should only be used where the matched resources are HTML resources. If JS or JSON resources are challenged, the client may receive an HTML challenge or block response instead of application/javascript or application/json.

HAR proof steps

1. Open /waf-test/index.php.
2. Open DevTools → Network.
3. Enable Preserve log and Disable cache.
4. Clear cookies if you want a clean first-request challenge.
5. Browser tab: choose /json-test/index.html, /json-test/app.js, or /json-test/api-test.json.
6. Click Run browser fetch() or Open target as top-level request.
7. Check the HAR/Network log for challenge, block, or origin responses.