How do client-side attacks bypass WAF signature-based detection?

WAF signatures are designed to catch known attack patterns in HTTP requests targeting server vulnerabilities by analyzing inbound requests. Client-side attacks use completely legitimate HTTP requests to deliver JavaScript that only becomes malicious when it executes in the browser. Often client-side attacks are fetched by the users browser from a 3rd party endpoint meaning the website' owners WAF is not even in the flow of the request rendering it useless Further still the malicious payload is often obfuscated or uses conditional logic that appear harmless in the HTTP request but reveals its malicious intentions only when running in a specific browser environment that your WAF never sees.