'AWS WAF block url was lacked

I'm using AWS WAF to block matched URL = "/login"

My context:

  • example.com (not block)
  • example.com/login (block)

Model: Internet -> ALB (with WAF) -> Web service (EC2) (nginx)

When the user accessed the login page directly (https://example.com/login) -> the request was blocked. WAF worked!

But when the user accessed the main page https://example.com and after that, they go https://example.com/login, the request was not blocked

Press ctrl + F5, page /login was blocked

What happens is going on and how to fix that? Thank!

This is my rule on WAF enter image description here

enter image description here



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source