Optional
Custom handler called instead of the default 403 response when mode === 'block' and the decision is 'block'.
403
mode === 'block'
'block'
'block' (default) — sends 403 Forbidden (or calls blockHandler) when the BBAS decision is 'block'.
403 Forbidden
blockHandler
'observe' — never blocks; attaches context and calls next() always. Useful for logging / shadow mode before enabling enforcement.
'observe'
next()
Custom handler called instead of the default
403response whenmode === 'block'and the decision is'block'.