AWS cognito: Note WAF custom block responses now return 403
Summary
Adds a document history entry noting Cognito now returns a 403 status code instead of 5xx for AWS WAF custom block responses in managed login and classic hosted UI.
Security assessment
Documents a behavior change in WAF block response status codes; security-adjacent but not a fix for a specific vulnerability.
Evidence
+[Status codes in AWS WAF custom block responses](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html#user-pool-waf-custom-response-status)| Amazon Cognito now returns a `403` status code in place of `5xx` status codes from AWS WAF custom block responses in managed login and the classic hosted UI.| October 1, 2026
Diff
diff --git a/cognito/latest/developerguide/cognito-document-history.md b/cognito/latest/developerguide/cognito-document-history.md index 286f075..2cb8c3d 100644 --- a//cognito/latest/developerguide/cognito-document-history.md +++ b//cognito/latest/developerguide/cognito-document-history.md @@ -12,0 +13 @@ Change| Description| Date +[Status codes in AWS WAF custom block responses](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html#user-pool-waf-custom-response-status)| Amazon Cognito now returns a `403` status code in place of `5xx` status codes from AWS WAF custom block responses in managed login and the classic hosted UI.| October 1, 2026