How do conditional client-side attacks avoid WAF detection?

Sophisticated client-side attacks use conditional logic that only triggers under specific circumstances - certain geographic locations, specific times, or particular user behaviors. Since WAFs analyze requests at delivery time rather than execution time, they can't detect these conditional payloads. A script might appear completely benign when your WAF examines the initial request, but turn malicious only when specific conditions are met in the user's browser environment.