Skip to content

Commit 8e46d4f

Browse files
patriciasantaanapatriciasantaana
authored
sequence mitigation custom rules (#18775)
1 parent 9f89da0 commit 8e46d4f

File tree

4 files changed

+106
-39
lines changed

4 files changed

+106
-39
lines changed

‎src/content/docs/api-shield/security/sequence-mitigation/configure.mdx‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
title: Configure Sequence Mitigation
33
pcx_content_type: how-to
44
type: overview
5+
sidebar:
6+
order: 1
57
head:
68
- tag: title
79
content: Configure Sequence Mitigation

‎src/content/docs/api-shield/security/sequence-mitigation/custom-rules.mdx‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
pcx_content_type: reference
3+
title: Sequence Mitigation custom rules
4+
sidebar:
5+
order: 2
6+
7+
---
8+
9+
import { GlossaryTooltip, Render } from "~/components"
10+
11+
API Shield sequence custom rules use the configured API Shield <GlossaryTooltip term="session identifier">session identifier</GlossaryTooltip> to track the order of requests a user has made and the time between requests, and makes them available via [Cloudflare Rules](/rules). This allows you to write rules that match valid or invalid sequences.
12+
13+
These rules are different from [cookie sequence rules](/bots/concepts/sequence-rules/) in a few ways:
14+
15+
- They only require an API Shield subscription.
16+
- They require [session identifiers](/api-shield/get-started/#session-identifiers) to be set in API Shield.
17+
- Because they use an API's session identifiers, they can be used for APIs designed for mobile applications.
18+
- Because Cloudflare stores the user state in memory and not in a cookie, the session lifetime is limited to 10 minutes.
19+
20+
Rules built using these custom rules are different from sequence mitigation rules built [via API or the Cloudflare dashboard](/api-shield/security/sequence-mitigation/). The custom rules syntax enables free-form logic and response options that the dashboard does not.
21+
22+
## Availability
23+
24+
<Render file="sequence-rules-availability" product="bots" />
25+
26+
## Example rules
27+
28+
Each saved endpoint will have an endpoint ID visible in its details page in Endpoint Management in the form of a UUID. The references below (`aaaaaaaa`, `bbbbbbbb`, and `cccccccc`) are the first eight characters of the endpoint ID.
29+
30+
The visitor must wait more than 2 seconds after requesting endpoint `aaaaaaaa` before requesting endpoint `bbbbbbbb`:
31+
32+
```txt
33+
cf.sequence.current_op eq "bbbbbbbb" and
34+
cf.sequence.msec_since_op["aaaaaaaa"] ge 2000
35+
```
36+
37+
The visitor must request endpoints `aaaaaaaa`, then `bbbbbbbb`, then `cccccccc` in that exact order:
38+
39+
```txt
40+
cf.sequence.current_op eq "cccccccc" and
41+
cf.sequence.previous_ops[0] == "bbbbbbbb" and
42+
cf.sequence.previous_ops[1] == "aaaaaaaa"
43+
```
44+
45+
The visitor must request endpoint `aaaaaaaa` before endpoint `bbbbbbbb`, but endpoint `aaaaaaaa` can be anywhere in the previous 10 requests:
46+
47+
```txt
48+
cf.sequence.current_op eq "bbbbbbbb" and
49+
any(cf.sequence.previous_ops[*] == "aaaaaaaa")
50+
```
51+
52+
The visitor must request either endpoint `aaaaaaaa` before endpoint `bbbbbbbb`, or endpoint `cccccccc` before endpoint `bbbbbbbb`:
53+
54+
```txt
55+
(cf.sequence.current_op eq "bbbbbbbb" and
56+
any(cf.sequence.previous_ops[*] == "aaaaaaaa")) or
57+
(cf.sequence.current_op eq "bbbbbbbb" and
58+
any(cf.sequence.previous_ops[*] == "cccccccc"))
59+
```

‎src/content/docs/bots/concepts/sequence-rules.mdx‎

Lines changed: 1 addition & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -56,45 +56,7 @@ Cloudflare only stores up to the 10 most recent operations in a sequence for up
5656

5757
## Availability
5858

59-
These sequence fields are available in:
60-
61-
- [Custom rules](/waf/custom-rules/) (`http_request_firewall_custom` phase)
62-
- [Rate limiting rules](/waf/rate-limiting-rules/) (`http_request_ratelimit`)
63-
- [Bulk redirects](/workers/examples/bulk-redirects/) (`http_request_redirect`)
64-
- [HTTP request header modification rules](/rules/transform/response-header-modification/) (`http_request_late_transform`)
65-
66-
<table>
67-
<thead>
68-
<tr>
69-
<th style="width: 35%;">Field name</th>
70-
<th>Description</th>
71-
<th>Example value</th>
72-
</tr>
73-
</thead>
74-
<tbody style='vertical-align:top'>
75-
<tr>
76-
<td><p><code>cf.sequence.current_op</code><br />`String`</p></td>
77-
<td>
78-
<p>This field contains the ID of the operation that matches the current request. If the current request does not match any operations defined in Endpoint Management, it will be an empty string.</p>
79-
</td>
80-
<td><p><code>c821cc00</code></p></td>
81-
</tr>
82-
<tr>
83-
<td><p><code>cf.sequence.previous_ops</code><br />`Array<String>`</p></td>
84-
<td>
85-
<p>This field contains an array of the prior operation IDs in the sequence, ordered from most to least recent. It does not include the current request. <br /><br /> If an operation is repeated, it will appear multiple times in the sequence.</p>
86-
</td>
87-
<td><p><code>["f54dac32", "c821cc00", "a37dc89b"]</code></p></td>
88-
</tr>
89-
<tr>
90-
<td><p><code>cf.sequence.msec_since_op</code><br />`Map<Number>`</p></td>
91-
<td>
92-
<p>This field contains a map where the keys are operation IDs and the values are the number of milliseconds since that operation has most recently occurred. <br /><br /> This does not include the current request or operation as it only factors in previous operations in the sequence.</p>
93-
</td>
94-
<td><p>`{"f54dac32": 1000, "c821cc00": 2000}`</p></td>
95-
</tr>
96-
</tbody>
97-
</table>
59+
<Render file="sequence-rules-availability" />
9860

9961
### Example rules
10062

‎src/content/partials/bots/sequence-rules-availability.mdx‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
{}
3+
4+
---
5+
6+
These sequence fields are available in:
7+
8+
- [Custom rules](/waf/custom-rules/) (`http_request_firewall_custom` phase)
9+
- [Rate limiting rules](/waf/rate-limiting-rules/) (`http_request_ratelimit`)
10+
- [Bulk redirects](/workers/examples/bulk-redirects/) (`http_request_redirect`)
11+
- [HTTP request header modification rules](/rules/transform/response-header-modification/) (`http_request_late_transform`)
12+
13+
<table>
14+
<thead>
15+
<tr>
16+
<th style="width: 35%;">Field name</th>
17+
<th>Description</th>
18+
<th>Example value</th>
19+
</tr>
20+
</thead>
21+
<tbody style='vertical-align:top'>
22+
<tr>
23+
<td><p><code>cf.sequence.current_op</code><br />`String`</p></td>
24+
<td>
25+
<p>This field contains the ID of the operation that matches the current request. If the current request does not match any operations defined in Endpoint Management, it will be an empty string.</p>
26+
</td>
27+
<td><p><code>c821cc00</code></p></td>
28+
</tr>
29+
<tr>
30+
<td><p><code>cf.sequence.previous_ops</code><br />`Array<String>`</p></td>
31+
<td>
32+
<p>This field contains an array of the prior operation IDs in the sequence, ordered from most to least recent. It does not include the current request. <br /><br /> If an operation is repeated, it will appear multiple times in the sequence.</p>
33+
</td>
34+
<td><p><code>["f54dac32", "c821cc00", "a37dc89b"]</code></p></td>
35+
</tr>
36+
<tr>
37+
<td><p><code>cf.sequence.msec_since_op</code><br />`Map<Number>`</p></td>
38+
<td>
39+
<p>This field contains a map where the keys are operation IDs and the values are the number of milliseconds since that operation has most recently occurred. <br /><br /> This does not include the current request or operation as it only factors in previous operations in the sequence.</p>
40+
</td>
41+
<td><p>`{"f54dac32": 1000, "c821cc00": 2000}`</p></td>
42+
</tr>
43+
</tbody>
44+
</table>

0 commit comments

Comments
 (0)