Multi-layer defense protecting transaction integrity, personal customer data (PII), inventory anti-scraping, and automated bot prevention.
Security policies enforced at the global CloudFront edge before any traffic can reach backend compute.
AWS Managed Rule Sets: Core Rule Set (CRS), Known Bad Inputs, Amazon IP Reputation list, and strict rate-limiting per IP (max 300 req / 5 min on checkout endpoints).
Privacy-preserving bot verification integrated seamlessly into login, checkout, and coupon redemption workflows to prevent automated credential stuffing and inventory hoarding.
S3 buckets for the SPAs and product images have 100% public access blocked. Requests are only authorized through SigV4-signed CloudFront service principals.
Standard HTTP response headers attached to all web traffic via CloudFront Response Headers Policy.
| Header | Configured Value | Protection Purpose |
|---|---|---|
Strict-Transport-Security |
max-age=63072000; includeSubDomains; preload |
Enforces TLS/HTTPS connections permanently |
X-Content-Type-Options |
nosniff |
Prevents MIME-type sniffing attacks |
X-Frame-Options |
DENY |
Eliminates Clickjacking risk completely |
Referrer-Policy |
strict-origin-when-cross-origin |
Prevents sensitive URL path leakage in referrers |
Permissions-Policy |
camera=(), microphone=(), geolocation=() |
Disables unneeded hardware API surfaces |