AWS WAF CAPTCHA with integration and without integration

I see. Does it mean the users will be allowed to solve the Captcha problem on the same web page (e.g. login page)? For example, with integration, when users access the login page, they are asked to solve the Captcha problem on the same login page.

Without integration, the flow will look like this. browse login page --> redirected to Captcha page --> redirected to login page again after solving Captcha

Is that correct?

browse login page --> redirected to Captcha page --> redirected to login page again after solving Captcha

This part will be processed as follows. Perform CAPTCHA authentication when logging in on the login page --> redirected to login page again after solving Captcha
I think it's easier to understand what happens on the browser around here by looking at the "Network" tab in the browser's developer tools. In fact, you can see that when you access a web page that requires CAPTCHA authentication, a new page is loaded after authentication is completed. If you have CAPTCHA authentication integration enabled, you will notice that new pages will not load after authentication is complete.

Thank you so much, Riku. Can I also use Captcha or Challenge with POST requests? What I am trying to do is when users click submit in the login form, they will be presented with a Captcha or a Challenge. Only if they pass the Captcha or Challenge, their submit login attempt will be sent to the server.

I think it needs to be put in before running POST. In other words, you need to set it to the GET request of the screen that sends the POST request instead of setting it to the POST request. https://docs.aws.amazon.com/waf/latest/developerguide/waf-captcha-and-challenge-best-practices.html

Configure your Challenge and CAPTCHA use so that AWS WAF only sends CAPTCHA puzzles and silent challenges in response to GET text/html requests. You can't run either the puzzle or the challenge in response to POST requests, Cross-Origin Resource Sharing (CORS) preflight OPTIONS requests, or any other non-GET request types. Browser behavior for other request types can vary and might not be able to handle the interstitials properly.