Challenge Mode

Challenge mode adds an additional gate for HTTP tunnels. The intention is to block unwanted automated traffic before it reaches upstream services and before the engine evaluates authentication policies.

Challenge mode is configured as a boolean tunnel property and is exposed on the CLI through rstream forward --challenge-mode.

Relationship with authentication

Challenge mode does not replace token authentication or rstream auth. Authentication decisions are still driven by the tunnel authentication settings.