Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hello.

What does it mean when Ory responds with an error:

```Request has been marked as malicious```
?

It seems to clear when we retry the request, but it's a bad experience when first time customers encounter this.

Note: this got triggered when using Ory Hydra (on Ory Network), when doing the initial validation of the login challenge in production

It means our WAF assumes that the request made was malicious (high bot score, suspicious behavior). Does it happen often?

Hi <@U010F2N7G2X> :wave::skin-tone-4:

We're just beginning rollout (early testing), and it has happened for all of the 2 users who have gone through this flow today.

Is it possible to get more details about what characteristics triggered the WAF?

do you have access to the support/ticketing system?

screenshot-20250401-155946.png

<@U010F2N7G2X> This is all I see on support

Please send an email to <mailto:support@ory.sh|support@ory.sh> with the details <@U05KRCA37J7> - not sure which account you belong to since you signed up with a personal email.

Thanks <@U011D3UQKNY> - will do so shortly.