4 ms·
Damn this is absurd. Is there not a way on Clouldflare to flag webhooks with a "if request contains this api key, let it through, block the rest"?
by berkle4455 4y ago
Damn this is absurd. Is there not a way on Clouldflare to flag webhooks with a "if request contains this api key, let it through, block the rest"?
- a2tech 4y agoYou can create custom rulesets, which is what the article's author did. This allowed the API calls to essentially bypass the WAF.
- blibble 4y agojust remember sometimes cloudflare add new features which aren't controlled by existing rules "security off for this ip?" "I guess you don't mean our new shiny feature!"
- tyingq 4y agoIt looks like "WAF - add exceptions" supports Wireshark style expressions, so there's things like: (http.request.uri.query contains "some-string") Or similar for checking headers, post body content, etc.