Refuse requests above the threshold

Set action to deny on a Bot Manager Lite instance, from Azion Console, the Azion CLI, or the API, and read what a refused request receives.

Last updated

View as Markdown Agent setup

You can set a Bot Manager Lite instance to refuse a request whose score reaches the threshold, from Azion Console, the Azion CLI, or the API. A refused request receives HTTP 403 with the page titled Azion - Default error page, and nothing in that answer names Bot Manager.

Prerequisites

Console

Set the action to deny

The object below is one value away from the observation object: action reads deny, so the instance answers 403 to a request whose score reaches threshold instead of serving it. At 30, the threshold Bot Manager Lite ships, a browser is not refused. A Chrome request carrying Accept, Accept-Language, Accept-Encoding, four Sec-Fetch-* headers, and Upgrade-Insecure-Requests reaches the application under this object. internal_logs at 2 keeps a report line for every request, so a refusal leaves a record of the score behind it.

JSON
01{
02 "threshold": 30,
03 "action": "deny",
04 "internal_logs": 2,
05 "log_tag": "storefront-bots"
06}

For every argument an instance accepts, refer to Arguments.

Console

To set the action from Azion Console:

Open the firewall bound to your workload

Access Azion Console > Firewalls, then select that firewall.

Select the Functions Instances tab
Open the instance you want to change

On a firewall carrying no instance yet, select + Function, enter a Name, and select the Bot Manager Lite function in the Function section.

Enter the object in the Arguments section

The section holds a JSON editor, because Bot Manager Lite carries no argument schema to build a form from.

Select Save

The instance holds the new object. An instance already named by a rule keeps that rule: the arguments change under it, and no rule has to be touched.

Note — Allow about two minutes after any change before you read anything into a response. The object is not validated: an instance whose action is misspelled looks configured to refuse and refuses nothing. A threshold of 0 refuses every request the rule matches. A client that neither runs JavaScript nor keeps cookies never reaches a 403, and never reaches the application either. For what that client receives, refer to Troubleshoot Firewall.

Next steps

Read the report log for one instanceConfirm which instance refused a request, and what it scored.ArgumentsEvery argument an instance accepts, and what each action does at the threshold.