Skip to content

Commit 5e6f47e

Browse files
committed
Merge branch 'production' into api-redirect
2 parents 7acba38 + 51c7c53 commit 5e6f47e

File tree

6 files changed

+139
-36
lines changed

6 files changed

+139
-36
lines changed

.github/CODEOWNERS

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@
44

55
# More dev-specific files
66

7-
/.github/ @kodster28 @pedrosousa @haleycode @kristianfreeman @GregBrimble @KianNH @maxvp @marciocloudflare @WalshyDev
7+
/.github/ @cloudflare/pcx-content-engineering
88
/.github/CODEOWNERS @cloudflare/pcx-technical-writing
9-
/.github/actions/assign-pr/index.js @cloudflare/pcx-technical-writing
10-
/src/components/ @cloudflare/developer-advocacy @kristianfreeman @kodster28 @pedrosousa @marciocloudflare @haleycode @maxvp @GregBrimble @KianNH @WalshyDev
11-
*.js @cloudflare/developer-advocacy @kristianfreeman @kodster28 @pedrosousa @haleycode @GregBrimble @KianNH @WalshyDev
12-
*.ts @cloudflare/developer-advocacy @kristianfreeman @kodster28 @pedrosousa @haleycode @GregBrimble @KianNH @WalshyDev
13-
*.astro @cloudflare/developer-advocacy @kristianfreeman @kodster28 @pedrosousa @haleycode @GregBrimble @KianNH @WalshyDev
14-
/src/schemas/tags.ts @kodster28 @KianNH @joslyn-cf
15-
/src/content/workers-ai-models/ @craigsdennis @pedrosousa @cloudflare/pcx-technical-writing
16-
/public/__redirects @GregBrimble @KianNH @pedrosousa @WalshyDev @cloudflare/pcx-technical-writing
9+
/.github/actions/assign-pr/index.js @cloudflare/pcx-technical-writing @kodster28
10+
/src/components/ @cloudflare/pcx-content-engineering @kodster28
11+
*.js @cloudflare/pcx-content-engineering @kodster28
12+
*.ts @cloudflare/pcx-content-engineering @kodster28
13+
*.astro @cloudflare/pcx-content-engineering @kodster28
14+
/src/schemas/tags.ts @cloudflare/pcx-content-engineering @joslyn-cf @kodster28
15+
/src/content/workers-ai-models/ @craigsdennis @cloudflare/pcx-content-engineering @cloudflare/pcx-technical-writing @kodster28
16+
/public/__redirects @cloudflare/pcx-content-engineering @cloudflare/pcx-technical-writing @kodster28
1717

1818

1919
# AI

src/content/changelog/workers/2025-10-03-one-click-access-for-workers.mdx

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,14 @@ import { jwtVerify, createRemoteJWKSet } from "jose";
3434

3535
export default {
3636
async fetch(request, env, ctx) {
37+
// Verify the POLICY_AUD environment variable is set
38+
if (!env.POLICY_AUD) {
39+
return new Response('Missing required audience', {
40+
status: 403,
41+
headers: { 'Content-Type': 'text/plain' }
42+
});
43+
}
44+
3745
// Get the JWT from the request headers
3846
const token = request.headers.get("cf-access-jwt-assertion");
3947

@@ -81,4 +89,4 @@ Add these [environment variables](/workers/configuration/environment-variables/)
8189

8290
Both of these appear in the modal that appears when you enable Cloudflare Access.
8391

84-
You can set these variables by adding them to your Worker's [Wrangler configuration file](/workers/wrangler/configuration/), or via the Cloudflare dashboard under **Workers & Pages** > **your-worker** > **Settings** > **Environment Variables**.
92+
You can set these variables by adding them to your Worker's [Wrangler configuration file](/workers/wrangler/configuration/), or via the Cloudflare dashboard under **Workers & Pages** > **your-worker** > **Settings** > **Environment Variables**.

src/content/docs/api-shield/security/bola-vulnerability-detection.mdx

Lines changed: 85 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ sidebar:
99
label: BOLA vulnerability detection
1010
---
1111

12-
import { Badge } from "~/components";
12+
import { Badge, DashButton, Details, Steps } from "~/components";
1313

1414
A Broken Object Level Authorization (BOLA) vulnerability is where an application or API fails to properly verify if a user has permission to access specific data.
1515

@@ -21,46 +21,113 @@ BOLA vulnerabilities are as dangerous as an account takeover. Successfully explo
2121

2222
Cloudflare labels endpoints with BOLA risk when we detect two distinct signals common with attacks exploiting BOLA: **Parameter pollution** and **Enumeration**.
2323

24-
- **Parameter pollution**: Cloudflare detects anomalies where one or more successful requests containing a value in an expected path, query string or header have that value duplicated in an unexpected, similar location.
24+
## Enumeration
2525

26-
This behavior may be indicative of attackers trying to confuse the API’s authorization system and bypass security controls.
27-
28-
- **Enumeration**: Cloudflare continually profiles all sessions on a per-endpoint basis and detects anomalous sessions that successfully request many unique data points from an API endpoint against what is normal.
26+
Cloudflare continually profiles all sessions on a per-endpoint basis and detects anomalous sessions that successfully request many unique data points from an API endpoint against what is normal.
2927

3028
:::note
3129
Sessions that have more random behavior or repetition have a higher chance of triggering an alert.
3230

3331
The BOLA enumeration label requires an endpoint to have seen at least 10,000 sessions before being eligible for outlier detection.
3432
:::
3533

36-
## Examples
34+
<Details header="Enumeration example" open={true}>
35+
**Endpoint**: `GET /api/v1/users/{userId}/credit-cards`
3736

38-
### Parameter pollution attack
37+
- **Normal behavior**: Users request credit cards using only their own `userId`.
38+
- **Attack behavior**: Attackers request hundreds of `userId` values per session by brute-force iterating through `userIds` found via other methods.
39+
- **Result**: If the origin authorization policy is broken for this endpoint, the attacker gains credit card information on every user account they request it for.
40+
</Details>
3941

40-
**Endpoint**: `GET /api/v1/orders/{orderId}`
42+
## Parameter pollution
4143

42-
- **Normal behavior**: `orderId` sent in a path variable like `GET /api/v1/orders/12345`
43-
- **Attacker behavior**: `orderId` is also sent as a query parameter, triggering old, undocumented code that looks for orders in the query parameter and happens to lack an authorization check: `GET /api/v1/orders/12345?orderId=67890`
44-
- **Result**: By passing in a bogus order or an order that the attacker owns (`12345`), they are able to trigger the old, undocumented code and access an order that they do not own (`67890`)
44+
Cloudflare detects anomalies where one or more successful requests containing a value in an expected path, query string, header, or cookie have that value duplicated in an unexpected, similar location.
4545

46-
### BOLA enumeration attack
46+
This behavior may be indicative of attackers trying to confuse the API's authorization system and bypass security controls.
4747

48-
**Endpoint**: `GET /api/v1/users/{userId}/credit-cards`
48+
<Details header="Parameter pollution example" open={true}>
49+
**Endpoint**: `GET /api/v1/orders/{orderId}`
4950

50-
- **Normal behavior**: Users request credit cards using only their own `userId`.
51-
- **Attack behavior**: Attackers request hundreds of `userId` values per session by brute-force iterating through `userIds` found via other methods.
52-
- **Result**: If the authorization policy is broken for this endpoint, the attacker gains credit card information on every user account they request it for.
51+
- **Normal behavior**: `orderId` sent in a path variable like `GET /api/v1/orders/12345`
52+
- **Attacker behavior**: `orderId` is also sent as a query parameter, triggering old, undocumented code that looks for orders in the query parameter and happens to lack an authorization check: `GET /api/v1/orders/12345?orderId=67890`
53+
- **Result**: By passing in a fake order or an order that the attacker owns (`12345`), they are able to trigger the old, undocumented code and access an order that they do not own (`67890`)
54+
</Details>
5355

5456
## Process
5557

56-
For beta customers, API Shield searches for and highlights BOLA attacks on your APIs. Cloudflare learns visitor traffic patterns over time to know when API access to specific objects is likely a BOLA enumeration attack. We inform you what API endpoints are being targeted by automatically labeling them using the following risk labels:
58+
API Shield searches for and highlights BOLA attacks on your APIs. Cloudflare learns visitor traffic patterns over time to know when API access to specific objects is likely a BOLA enumeration attack. We inform you what API endpoints are being targeted by automatically labeling them using the following [risk labels](/api-shield/management-and-monitoring/endpoint-labels/#risk-labels):
5759

5860
`cf-risk-bola-enumeration`: Automatically added when an endpoint experiences successful responses with drastic differences in the number of unique elements requested by different user sessions.
5961

6062
`cf-risk-bola-pollution`: Automatically added when an endpoint experiences successful responses where parameters are found in multiple places in the request, as opposed to what is expected from the API's schema.
6163

6264
If you see one of these labels on your API endpoints, check its authorization policy with your developer team to find any authorization bugs. Additionally, you can reach out to Cloudflare for a customized report about the behavior, including attacker identifiers that you can use to confirm attack reach and impact.
6365

66+
BOLA attack information can be found in your [Security Overview](#security-overview) and [Endpoint details](#endpoint-details). Closed beta customers can find BOLA attack information in [Security Analytics](#security-analytics) as well.
67+
68+
### Security Overview
69+
70+
If BOLA vulnerabilities have been detected on your endpoints, you can view a summary of the attack and suggestions to mitigate it via the Cloudflare dashboard.
71+
72+
<Steps>
73+
1. In the Cloudflare dashboard, go to the **Security** page.
74+
75+
<DashButton url="/?to=/:account/:zone/security/overview" />
76+
2. Go to **API abuse** or **All suggestions**.
77+
3. Depending on the type of attack, select **Review traffic from potential BOLA enumeration attack** or **Review traffic from potential parameter pollution attack** to view details of the attack and suggested actions.
78+
4. Select **View all affected endpoints** or **View details** on a specific endpoint to review suspicious sessions in [Web Assets](#endpoint-details).
79+
</Steps>
80+
81+
Cloudflare evaluates your session requests for both enumeration and parameter pollution attacks and provides you with a list of at-risk endpoints and the number of anomalous sessions where an attack was detected. You can follow the suggested actions to address your BOLA vulnerabilities and prevent future attacks against your endpoints.
82+
83+
:::note
84+
If the insight has been archived but attacks are still present, you can filter by **Show archived**.
85+
:::
86+
87+
### Security Analytics
88+
89+
You can view analytics of your zone's traffic profile and suspicious requests associated with enumeration or parameter pollution attacks in the Cloudflare dashboard.
90+
91+
<DashButton url="/?to=/:account/:zone/security/analytics" />
92+
93+
Filter requests depending on the type of attack detected in your zone, including the hashed session IDs found in the attack and the corresponding BOLA vulnerability risk label, to see an analysis of your request activity from the past seven days. This filter includes all traffic from suspected attacker sessions, so you can evaluate other actions that they are taking against your zone.
94+
95+
This does not filter by specific endpoints.
96+
97+
Review the top statistics and details of managed API endpoints, paths and values targeted by the attack, source IPs, source user agents, and source fingerprints.
98+
99+
Cloudflare recommends that you observe your traffic profile for any anomalies in its normal behavior.
100+
101+
:::note[Availability]
102+
BOLA attacks in Security Analytics is currently available in closed beta.
103+
:::
104+
105+
### Endpoint details
106+
107+
You can expand the endpoint details in Web Assets to access information on suspicious sessions' activity on the endpoint, including both enumeration attack and parameter pollution attack details.
108+
109+
<DashButton url="/?to=/:account/:zone/security/web-assets" />
110+
111+
Under **Security overview**, select **View attack** to review affected sessions with its associated IP addresses and JA4 fingerprints.
112+
113+
You can export the `.csv` file containing all the IP addresses and JA4 fingerprints for all or only a specific session.
114+
115+
:::note
116+
The hashed session ID is used for privacy purposes and only as a unique identifier for a specific session. It cannot be un-hashed. It will not match your customer values in your application or database.
117+
:::
118+
119+
The details specify the parameter that was affected, the number of sessions involved in the attack, and how far their behavior deviated from baseline.
120+
121+
If unauthorized access to the parameter was obtained, consider the potential impact to your application, users, and data. As a best practice, consult with your application and API developers to confirm unauthorized access by reviewing your API origin logs for the IP address and JA4 fingerprint of the abusive sessions.
122+
123+
Closed beta customers can view attack data in [Security Analytics](#security-analytics).
124+
125+
<DashButton url="/?to=/:account/:zone/security/analytics" />
126+
127+
The managed endpoint will be automatically filtered in the request activity from the past seven days. You can also filter by suspicious IP addresses and fingerprints found in the attack details.
128+
129+
---
130+
64131
## Availability
65132

66-
BOLA attack detection is available in a closed beta. Contact your account team if you are interested in BOLA attack detection for your API.
133+
Details of BOLA attacks visible in Security Analytics are only available for customers in the closed beta.

src/content/docs/cloudflare-one/identity/authorization-cookie/validating-json.mdx

Lines changed: 34 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,14 @@ import { jwtVerify, createRemoteJWKSet } from 'jose';
113113

114114
export default {
115115
async fetch(request, env, ctx) {
116+
// Verify the POLICY_AUD environment variable is set
117+
if (!env.POLICY_AUD) {
118+
return new Response('Missing required audience', {
119+
status: 403,
120+
headers: { 'Content-Type': 'text/plain' }
121+
});
122+
}
123+
116124
// Get the JWT from the request headers
117125
const token = request.headers.get('cf-access-jwt-assertion');
118126

@@ -268,6 +276,10 @@ def verify_token(f):
268276
Decorator that wraps a Flask API call to verify the CF Access JWT
269277
"""
270278
def wrapper():
279+
# Check for the POLICY_AUD environment variable
280+
if not POLICY_AUD:
281+
return "missing required audience", 403
282+
271283
token = ''
272284
if 'CF_Authorization' in request.cookies:
273285
token = request.cookies['CF_Authorization']
@@ -319,6 +331,14 @@ const JWKS = jose.createRemoteJWKSet(new URL(CERTS_URL));
319331

320332
// verifyToken is a middleware to verify a CF authorization token
321333
const verifyToken = async (req, res, next) => {
334+
// Check for the AUD environment variable
335+
if (!AUD) {
336+
return res.status(403).send({
337+
status: false,
338+
message: "missing required audience",
339+
});
340+
}
341+
322342
const token = req.headers["cf-access-jwt-assertion"];
323343

324344
// Make sure that the incoming request has our token header
@@ -329,13 +349,20 @@ const verifyToken = async (req, res, next) => {
329349
});
330350
}
331351

332-
const result = await jose.jwtVerify(token, JWKS, {
333-
issuer: TEAM_DOMAIN,
334-
audience: AUD,
335-
});
352+
try {
353+
const result = await jose.jwtVerify(token, JWKS, {
354+
issuer: TEAM_DOMAIN,
355+
audience: AUD,
356+
});
336357

337-
req.user = result.payload;
338-
next();
358+
req.user = result.payload;
359+
next();
360+
} catch (err) {
361+
return res.status(403).send({
362+
status: false,
363+
message: "invalid token",
364+
});
365+
}
339366
};
340367

341368
const app = express();
@@ -347,4 +374,4 @@ app.get("/", (req, res) => {
347374
});
348375

349376
app.listen(3333);
350-
```
377+
```

src/content/docs/cloudflare-one/policies/gateway/http-policies/granular-controls.mdx

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ To use Application Granular Controls, you must:
1717
- Turn on [TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/).
1818
- Turn on the [Gateway proxy](/cloudflare-one/policies/gateway/proxy/#turn-on-the-gateway-proxy).
1919
- (Optional) If an application uses HTTP/3, turn on the [Gateway proxy for UDP traffic](/cloudflare-one/policies/gateway/http-policies/http3/#enable-http3-inspection).
20+
- (Optional) To turn on [AI prompt logging](/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options/#log-generative-ai-prompt-content), create a [DLP payload encryption public key](/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options/#set-a-dlp-payload-encryption-public-key).
2021

2122
## Create a policy with Application Granular Controls
2223

src/content/docs/containers/platform-details/architecture.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ This allows you to gracefully shutdown any running instances during a rollout. R
1919

2020
### Client to Worker
2121

22-
Recall that Containers are backed by Durable Objects and Workers.
22+
Recall that Containers are backed by [Durable Objects](/durable-objects/) and [Workers](/workers/).
2323
Requests are first routed through a Worker, which is generally handled
2424
by a datacenter in a location with the best latency between itself and the requesting user.
2525
A different datacenter may be selected to optimize overall latency, if [Smart Placement](/workers/configuration/smart-placement/)

0 commit comments

Comments
 (0)