Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ The descriptions below detail the fields available for `firewall_events`.

Type: `string`

The code of the first-class action the Cloudflare Firewall took on this request. <br />Possible actions are <em>unknown</em> \| <em>allow</em> \| <em>block</em> \| <em>challenge</em> \| <em>jschallenge</em> \| <em>log</em> \| <em>connectionclose</em> \| <em>challengesolved</em> \| <em>challengefailed</em> \| <em>challengebypassed</em> \| <em>jschallengesolved</em> \| <em>jschallengefailed</em> \| <em>jschallengebypassed</em> \| <em>bypass</em> \| <em>managedchallenge</em> \| <em>managedchallengeskipped</em> \| <em>managedchallengenoninteractivesolved</em> \| <em>managedchallengeinteractivesolved</em> \| <em>managedchallengebypassed</em>.
The code of the first-class action the Cloudflare Firewall took on this request. <br />Possible actions are <em>unknown</em> \| <em>allow</em> \| <em>block</em> \| <em>challenge</em> \| <em>jschallenge</em> \| <em>log</em> \| <em>connectionclose</em> \| <em>challengesolved</em> \| <em>challengebypassed</em> \| <em>jschallengesolved</em> \| <em>jschallengebypassed</em> \| <em>bypass</em> \| <em>managedchallenge</em> \| <em>managedchallengenoninteractivesolved</em> \| <em>managedchallengeinteractivesolved</em> \| <em>managedchallengebypassed</em>.

## ClientASN

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -481,7 +481,7 @@ Action of the security rule that triggered a terminating action, if any.

Type: `array[string]`

Array of actions the Cloudflare security products performed on this request. The individual security products associated with this action be found in SecuritySources and their respective rule Ids can be found in SecurityRuleIDs. The length of the array is the same as SecurityRuleIDs and SecuritySources. <br />Possible actions are <em>unknown</em> \| <em>allow</em> \| <em>block</em> \| <em>challenge</em> \| <em>jschallenge</em> \| <em>log</em> \| <em>connectionClose</em> \| <em>challengeSolved</em> \| <em>challengeFailed</em> \| <em>challengeBypassed</em> \| <em>jschallengeSolved</em> \| <em>jschallengeFailed</em> \| <em>jschallengeBypassed</em> \| <em>bypass</em> \| <em>managedChallenge</em> \| <em>managedChallengeSkipped</em> \| <em>managedChallengeNonInteractiveSolved</em> \| <em>managedChallengeInteractiveSolved</em> \| <em>managedChallengeBypassed</em> \| <em>rewrite</em> \| <em>forceConnectionClose</em> \| <em>skip</em> \| <em>managedChallengeFailed</em>.
Array of actions the Cloudflare security products performed on this request. The individual security products associated with this action be found in SecuritySources and their respective rule Ids can be found in SecurityRuleIDs. The length of the array is the same as SecurityRuleIDs and SecuritySources. <br />Possible actions are <em>unknown</em> \| <em>allow</em> \| <em>block</em> \| <em>challenge</em> \| <em>jschallenge</em> \| <em>log</em> \| <em>connectionClose</em> \| <em>challengeSolved</em> \| <em>challengeBypassed</em> \| <em>jschallengeSolved</em> \| <em>jschallengeBypassed</em> \| <em>bypass</em> \| <em>managedChallenge</em> \| <em>managedChallengeNonInteractiveSolved</em> \| <em>managedChallengeInteractiveSolved</em> \| <em>managedChallengeBypassed</em> \| <em>rewrite</em> \| <em>forceConnectionClose</em> \| <em>skip</em>.

## SecurityRuleDescription

Expand Down
3 changes: 0 additions & 3 deletions src/content/docs/logs/reference/security-fields.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,8 @@ The Security fields contain rules to block requests that contain specific types
| `log` | Log | Take no action other than logging the event. |
| `connectionClose` | Close | Close connection. |
| `challengeSolved` | Allow | Allow once interactive challenge solved. |
| `challengeFailed` | Drop | Block following invalid interactive challenge solve attempt. |
| `challengeBypassed` | Allow | Interactive challenge is not issued again because the visitor had previously passed an interactive challenge and a valid `cf_clearance` cookie is present. |
| `jschallengeSolved` | Allow | Allow once JS challenge solved. |
| `jschallengeFailed` | Drop | Drop if JS challenge failed. |
| `jschallengeBypassed` | Allow | JS challenge not issued because the visitor had previously passed a JS or interactive challenge. |
| `bypass` | Allow | Bypass all subsequent firewall rules. |
| `managedChallenge` | Challenge Drop | Issue managed challenge. |
Expand Down Expand Up @@ -61,4 +59,3 @@ The Security fields contain rules to block requests that contain specific types
| `dlp` | Allow or block based on the Data Loss Prevention product settings. |
| `firewallManaged` | Allow or block based on WAF Managed Rules' settings. |
| `firewallCustom` | Allow or block based on a rule configured in WAF custom rules. |

14 changes: 5 additions & 9 deletions src/content/docs/waf/troubleshooting/faq.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -163,13 +163,7 @@ Previously, unless you customize your front-end application, any AJAX request th

Now, you can [opt-in to Turnstile’s Pre-Clearance cookies](/turnstile/concepts/pre-clearance-support/). This allows you to issue a challenge early in your web application flow and pre-clear users to interact with sensitive APIs. Clearance cookies issued by a Turnstile widget are automatically applied to the Cloudflare zone that the Turnstile widget is embedded on, with no configuration necessary. The duration of the clearance cookie’s validity is controlled by the zone-specific configurable [Challenge Passage](/waf/tools/challenge-passage/) security setting.

### ​​Does the challengeFailed action accurately represent challenges that users did not pass?

No. The `challengeFailed` and `jschallengeFailed` firewall rule actions account for observed requests that, under special circumstances, did not pass a challenge. However, some failed challenges cannot be traced back to a firewall rule. Additionally, Cloudflare Firewall Rules may not have a record of every request with a failed challenge.

Therefore, consider these actions with caution. A reliable indicator is the [Challenge Solve Rate (CSR)](/bots/concepts/challenge-solve-rate/) displayed in **Security** > **WAF** > **Firewall rules**, which is calculated as follows: `number of challenges solved / number of challenges issued`.

### Why would I not find any failed challenges? Why is ChallengeIssued not equal to ChallengeSolved plus ChallengeFailed?
### Why would I not find any failed challenges?

Users do not complete all challenges. Cloudflare issues challenges that are never answered — only 2-3% of all served challenges are usually answered.

Expand All @@ -180,10 +174,12 @@ There are multiple reasons for this:
- Users keep refreshing the challenge, but never submit an answer.
- Cloudflare receives a malformed challenge answer.

You can calculated the number of failed challenges as follows: `number of challenges issued - number of challenges solved`.

### Why do I have matches for a firewall rule that was not supposed to match the request?

Make sure you are looking at the correct request.

Only requests that triggered a challenge will match the request parameters of the rule. Subsequent requests with a `[js]challengeSolved` or `[js]challengeFailed` action may not match the parameters of the rule — for example, the bot score may have changed because the user solved a challenge.
Only requests that triggered a challenge will match the request parameters of the rule. Subsequent requests with a `[js]challengeSolved` action may not match the parameters of the rule — for example, the bot score may have changed because the user solved a challenge.

The "solved" and "failed" actions are informative actions about a previous request that matched a rule. These actions state that "previously a rule had matched a request with the action set to _Interactive Challenge_ or _JS Challenge_ and now that challenge was answered."
The "solved" action is an informative action about a previous request that matched a rule. This action states that "previously a rule had matched a request with the action set to _Interactive Challenge_ or _JS Challenge_ and now that challenge was answered."
Loading