Bot Defense CORS lab

Frontend calling a cross-origin API. Point the API at nginx (strict CORS) to see the failure, or at the BIG-IP VS with the iRule to see the fix.

API base URL

Simulated Bot Defense JS injected

When on, every fetch/XHR to the API gets xa4vrhyp3q-* headers, like the real injected JS. Suffixes are placeholders.

Tests

Log

Open DevTools → Network to see the OPTIONS preflights.