Skip to content

Commit 2ca8cd7

Browse files
authored
Update automatic-request-headers.mdx
-capitalized the signature headers -fixed link for signature agent (does not have the .well-known path) -added back in instructions on how to verify using web bot auth
1 parent d08d613 commit 2ca8cd7

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

src/content/docs/browser-rendering/reference/automatic-request-headers.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ These headers are meant to ensure transparency and cannot be removed or overridd
1717
| -------------------- | ----------------------------------------------------------------------------------- |
1818
| `cf-biso-request-id` | A unique identifier for the Browser Rendering request |
1919
| `cf-biso-devtools` | A flag indicating the request originated from Cloudflare's rendering infrastructure |
20-
| `signature-agent` | [The location of the bot public keys](https://web-bot-auth.cloudflare-browser-rendering-085.workers.dev/.well-known/http-message-signatures-directory), used to sign the request and verify it came from Cloudflare |
21-
| `signature` and `signature-input`| A digital signature, used to verify requests, as shown in [this architecture document](https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture) |
20+
| `Signature-agent` | [The location of the bot public keys](https://web-bot-auth.cloudflare-browser-rendering-085.workers.dev), used to sign the request and verify it came from Cloudflare |
21+
| `Signature` and `Signature-input`| A digital signature, used to validate requests, as shown in [this architecture document](https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture) |
2222

23-
The `signature` headers use an authentication method called [Web Bot Auth](/bots/concepts/bot/verified-bots/web-bot-auth/). Web Bot Auth leverages cryptographic signatures in HTTP messages to verify that a request comes from an automated bot.
23+
The `Signature` headers use an authentication method called [Web Bot Auth](/bots/concepts/bot/verified-bots/web-bot-auth/). Web Bot Auth leverages cryptographic signatures in HTTP messages to verify that a request comes from an automated bot. To verify a request originated from Cloudflare Browser Rendering, use the keys found on [this directory](https://web-bot-auth.cloudflare-browser-rendering-085.workers.dev/.well-known/http-message-signatures-directory) to verify the `Signature` and `Signature-Input` found in the headers from the incoming request. A successful verification proves that the request originated from Cloudflare Browser Rendering and has not been tampered with in transit.

0 commit comments

Comments
 (0)