Re webapp, I found this snippet in [0] > After a visitor authenticates to Cloudflare Access, all subsequent requests to the application server contain a Cf-Acc

Re webapp, I found this snippet in [0] > After a visitor authenticates to Cloudflare Access, all subsequent requests to the application server contain a Cf-Access-Authenticated-User-Email header with the authenticated user. Our example uses user@example.com. This allows you to identify the user currently logged in. So authorization is still app's responsibility, but at least the authentication is handled. Well, at least plain-text list of admins' emails is much easier to implement than full user-password database. Regarding SSH, that requirement does sound annoying, agree that Bastion-zero's approach is superior. [0] https://developers.cloudflare.com/cloudflare-one/identity/users/validating-json#user-identity https://developers.cloudflare.com/cloudflare-one/identity/us...