You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-capitalized the signature headers
-fixed link for signature agent (does not have the .well-known path)
-added back in instructions on how to verify using web bot auth
|`cf-biso-request-id`| A unique identifier for the Browser Rendering request |
19
19
|`cf-biso-devtools`| A flag indicating the request originated from Cloudflare's rendering infrastructure |
20
-
|`signature-agent`|[The location of the bot public keys](https://web-bot-auth.cloudflare-browser-rendering-085.workers.dev/.well-known/http-message-signatures-directory), used to sign the request and verify it came from Cloudflare |
21
-
|`signature` and `signature-input`| A digital signature, used to verify requests, as shown in [this architecture document](https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture)|
20
+
|`Signature-agent`|[The location of the bot public keys](https://web-bot-auth.cloudflare-browser-rendering-085.workers.dev), used to sign the request and verify it came from Cloudflare |
21
+
|`Signature` and `Signature-input`| A digital signature, used to validate requests, as shown in [this architecture document](https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture)|
22
22
23
-
The `signature` headers use an authentication method called [Web Bot Auth](/bots/concepts/bot/verified-bots/web-bot-auth/). Web Bot Auth leverages cryptographic signatures in HTTP messages to verify that a request comes from an automated bot.
23
+
The `Signature` headers use an authentication method called [Web Bot Auth](/bots/concepts/bot/verified-bots/web-bot-auth/). Web Bot Auth leverages cryptographic signatures in HTTP messages to verify that a request comes from an automated bot. To verify a request originated from Cloudflare Browser Rendering, use the keys found on [this directory](https://web-bot-auth.cloudflare-browser-rendering-085.workers.dev/.well-known/http-message-signatures-directory) to verify the `Signature` and `Signature-Input` found in the headers from the incoming request. A successful verification proves that the request originated from Cloudflare Browser Rendering and has not been tampered with in transit.
0 commit comments