Fire every shipped WAF test case (GET and POST) at this host and see, live, what Apigee stops — matched rule, violation code and support id. The lab tests the host that serves it (same-origin is the only way a browser can read an Apigee block); use the switch to flip between the protected and unprotected host.
| Attack | Method | Expect | Status | Result | Rule / violation | Verdict |
|---|
Same-origin only: a browser can read a WAF 403 block and the
x-apigee-* headers just for the host serving this page. One case
(scanner User-Agent) can't run in-browser because scripts may not set
User-Agent — run it with curl. For the machine-readable matrix
and the open-host control, use test_apigee_live.py. Generated by
gen_apigee_lab.py from test_apigee_live.py.