After a wave of credential stuffing against our login endpoint arrived mostly through Tor and anonymising proxies, we added IP reputation controls in AWS WAF. When blocking Tor is reasonable and when it is not, which managed rule groups to use, why we started in count mode, and how we handled false positives.
After a framework upgrade, our CDN cache hit ratio for static assets dropped from 97 to 41 percent and origin data transfer doubled. The new session middleware attached Set-Cookie and Cache-Control private to every response, including JavaScript bundles. Scoping middleware fixed it.
Our WAF rate limit and managed rules worked perfectly, for anyone polite enough to go through CloudFront. A scripted client hitting the ALB hostname directly skipped all of it. Here is how we found it, why it happens, and the layered origin protection we now ship by default.