I have set up an AWS WAF to protect my API with targeted bot control. I use the fetch wrapper AwsWafIntegration.fetch() to call the api, however when I call the API from localhost the WAF responds with a status 202 challenge that does not get handled. I presume this is because I do not have localhost in the token domain list, since if I access the api from a domain that is on the list it works as expected. I tried to remedy this by adding localhost to the list, but it is not accepted as a valid entry when I edit the list using the web console.

I have also tried getting the token directly and adding it to the headers in a normal fetch request:

headers['x-aws-waf-token'] = await AwsWafIntegration.getToken();
fetch(requestUrl, { headers });

but this did not work either.

Is there some way to get this to work so that I can use the API from localhost? Of course I could bypass the WAF for localhost but this would open a large security hole.