WAF: required header with secret value

[plush parrot]

no! that will not match if the user does not send authortization header at all

you need to not any(http.request.headers["authorization"][*] eq "Bearer SECRET_KEY")