Automating UI Tests Without Bot Detection Challenges

This article explains why automated User Interface (UI) test suites may trigger bot verification challenges during the login process and describes the current limitations for exempting specific test accounts. Testing environments such as Amazon Web Services (AWS) CodePipeline or other Cloud-based runners often use dynamic Internet Protocol (IP) addresses that the bot detection system may flag as suspicious.

• Bot Detection

• Automated Testing

Bot Detection is a tenant-level configuration that evaluates request risks based on IP addresses, headers, and behavioral patterns before the identity of a user is confirmed. Because the security check occurs prior to or during the authentication process, the system cannot determine the specific username or email to allow for a bypass. Currently, the system does not support "user allowlisting" or disabling the feature for specific client applications within the same tenant.

Since Bot Detection cannot be disabled for individual applications or specific users within a single tenant, use the following best practices for headless CI environments:

1. Use a dedicated development or testing tenant where Bot Detection is disabled to run automated UI tests.

2. For tracking purposes, reference feature request PDOPPS-6984 when inquiring with support regarding future updates for user-based bot detection exemptions.