Yandex Adds Cookie and JavaScript Checks to Web Security

Yandex Smart Web Security now uses automatic Cookie and JavaScript challenges before CAPTCHA or blocking, alongside three protection modes.

Yandex Tech has added automatic Cookie Challenge and JS Challenge checks to Yandex Smart Web Security, placing softer traffic tests between allowing a request and escalating to CAPTCHA or blocking. The system is intended to protect customer websites and APIs from unwanted automation and application-layer DDoS attacks.

The checks form part of a staged decision process. Requests in the system’s “gray zone” can first receive a Cookie or JavaScript challenge, while traffic that remains suspicious can be escalated to CAPTCHA or blocking. Challenge results and collected technical signals also inform later requests from the device, including its bot score. Yandex cautions that passing a challenge does not prove a request came from a person because automated browsers can support cookies and JavaScript.

Cookie Challenge uses HTTP 307 redirects and a temporary service cookie. The browser repeats the request with that marker before a second redirect removes it. Because a 307 redirect preserves the HTTP method and request body, Yandex says this check can handle browser-based POST submissions. Its main cost is the additional network delay caused by redirects.

JS Challenge instead uses a 302 redirect, cookies, JavaScript and analysis that includes machine-learning models. Yandex says it usually takes 200–1,000 milliseconds. It is designed primarily for navigation between HTML pages: browsers may convert a POST request into GET after a 302 redirect and discard its body, making Cookie Challenge the preferred option for forms and other POST requests.

The service now offers Normal, Enhanced Protection and Under Attack modes. Customers can switch modes manually or automatically at a configured load threshold and associate rules with each mode. Normal mode prioritizes minimal impact under stable traffic; Enhanced Protection applies soft checks more often when load looks suspicious; Under Attack increases scrutiny during an evident attack or critical load.

For Smart Protection in Full Protection mode, Yandex reports an 80% increase in bot-detection recall, roughly three times fewer CAPTCHA or blocking encounters for people, and a 1.4-fold increase in attacks addressed from the first request. These are vendor-reported results, and the post provides no independent evaluation. In practical terms, the staged design creates an intermediate response for uncertain traffic, but compatibility remains decisive: JavaScript and cookies are required for JS Challenge, while Cookie Challenge requires cookie support. Mobile apps, cookie-less domains, AJAX, cross-origin iframes and partner APIs may be unsuitable where a challenge could disrupt integration.

Challenge	Mechanism	Requirements	Main limitation
Cookie Challenge	HTTP 307 redirects and a temporary service cookie	Cookie support	Additional network latency from redirects
JS Challenge	HTTP 302 redirect, signal analysis and machine-learning models	Cookies and JavaScript	Not designed to preserve a POST request body

Sources

• habr.com

Originally published by AI Feed: Yandex Adds Cookie and JavaScript Checks to Web Security.