diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 56c5f5e43b55354..0a4a2fcff77ca28 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -212,6 +212,7 @@ /src/content/docs/waf/ @pedrosousa @cloudflare/firewall @cloudflare/pcx-technical-writing /src/content/docs/waf/change-log/ @pedrosousa @cloudflare/firewall @vs-mg @cloudflare/pcx-technical-writing /src/content/release-notes/waf.yaml @pedrosousa @cloudflare/firewall @vs-mg @cloudflare/pcx-technical-writing +/src/content/docs/cloudflare-challenges/ @patriciasantaana @cloudflare/pcx-technical-writing # Support diff --git a/public/__redirects b/public/__redirects index 4b5cebf3d34adad..c878cdab71de66d 100644 --- a/public/__redirects +++ b/public/__redirects @@ -232,6 +232,7 @@ /bots/get-started/free/ /bots/get-started/bot-fight-mode/ 301 /bots/get-started/bm-subscription/ /bots/get-started/bot-management/ 301 /bots/get-started/pro/ /bots/get-started/super-bot-fight-mode/ 301 +/bots/additional-configurations/javascript-detections/ /cloudflare-challenges/challenge-types/javascript-detections/ 301 #browser-rendering /browser-rendering/get-started/browser-rendering-with-do/ /browser-rendering/workers-binding-api/browser-rendering-with-do/ 301 diff --git a/src/content/docs/bots/additional-configurations/javascript-detections.mdx b/src/content/docs/bots/additional-configurations/javascript-detections.mdx index 26b515ec427d31a..8eb15a014a93a50 100644 --- a/src/content/docs/bots/additional-configurations/javascript-detections.mdx +++ b/src/content/docs/bots/additional-configurations/javascript-detections.mdx @@ -1,46 +1,7 @@ --- -type: overview -pcx_content_type: reference +pcx_content_type: concept title: JavaScript detections +external_link: /cloudflare-challenges/challenge-types/javascript-detections/ sidebar: - order: 6 ---- - -import { Render } from "~/components" - - - -## Enable JavaScript detections - -For Free customers (Bot Fight Mode), JavaScript detections are automatically enabled and cannot be disabled. - -For all other customers (Super Bot Fight Mode and Bot Management for Enterprise), JavaScript detections are optional. - - - -For more details on how to set up bot protection, see [Get started](/bots/get-started/). - -## Enforcing execution of JavaScript detections - - - - - -## Limitations - -### If you enabled Bot Management before June 2020 - -Customers who enabled Enterprise Bot Management before June 2020 do not have JavaScript detections enabled by default (unless specifically requested). These customers can still enable the feature in the Cloudflare dashboard. - -### If you have a Content Security Policy (CSP) - - - -:::caution[Warning] - -JavaScript detections are not supported with `nonce` set via `` tags. -::: - -### If you have ETags - -Enabling JavaScript Detections (JSD) will strip [ETags](/cache/reference/etag-headers/) from HTML responses where JSD is injected. + order: 2 +--- \ No newline at end of file diff --git a/src/content/docs/bots/get-started/bot-management.mdx b/src/content/docs/bots/get-started/bot-management.mdx index 6d55c166207f6cd..e2f0f38f69ef018 100644 --- a/src/content/docs/bots/get-started/bot-management.mdx +++ b/src/content/docs/bots/get-started/bot-management.mdx @@ -51,7 +51,7 @@ You can view blocked AI bot traffic via [Security Analytics](/waf/analytics/secu Enabling [JavaScript detections](/bots/additional-configurations/javascript-detections/) validates that the browser can run JavaScript, and is stored in the `cf.bot_management.js_detection.passed` variable. - + ### Deploy default templates diff --git a/src/content/docs/cloudflare-challenges/challenge-types/javascript-detections.mdx b/src/content/docs/cloudflare-challenges/challenge-types/javascript-detections.mdx index 089a73e98fb21ac..6134c98fa8ae2d4 100644 --- a/src/content/docs/cloudflare-challenges/challenge-types/javascript-detections.mdx +++ b/src/content/docs/cloudflare-challenges/challenge-types/javascript-detections.mdx @@ -1,7 +1,47 @@ + --- -pcx_content_type: concept +type: overview +pcx_content_type: reference title: JavaScript detections -external_link: /bots/additional-configurations/javascript-detections/ sidebar: - order: 2 ---- \ No newline at end of file + order: 6 +--- + +import { Render } from "~/components" + + + +## Enable JavaScript detections + +For Bot Fight Mode customers, JavaScript detections are automatically enabled and cannot be disabled. + +For Super Bot Fight Mode and Bot Management for Enterprise customers, JavaScript detections are optional. + + + +For more details on how to set up bot protection, refer to the [Bots documentation](/bots/get-started/). + +## Enforcing execution of JavaScript detections + + + + + +## Limitations + +### If you enabled Bot Management before June 2020 + +Customers who enabled Enterprise Bot Management before June 2020 do not have JavaScript detections enabled by default (unless specifically requested). These customers can still enable the feature in the Cloudflare dashboard. + +### If you have a Content Security Policy (CSP) + + + +:::caution[Warning] + +JavaScript detections are not supported with `nonce` set via `` tags. +::: + +### If you have ETags + +Enabling JavaScript Detections (JSD) will strip [ETags](/cache/reference/etag-headers/) from HTML responses where JSD is injected. diff --git a/src/content/docs/cloudflare-challenges/index.mdx b/src/content/docs/cloudflare-challenges/index.mdx index 0eb1492d0cc570d..2e1beee14ec03a1 100644 --- a/src/content/docs/cloudflare-challenges/index.mdx +++ b/src/content/docs/cloudflare-challenges/index.mdx @@ -11,8 +11,6 @@ import { Render, Description, Plan, RelatedProduct } from "~/components"; Challenges are security mechanisms used by Cloudflare to verify whether a visitor to your site is a real human and not a bot or automated script. - - When a challenge is issued, Cloudflare asks the browser to perform a series of checks that help confirm the visitor’s legitimacy. This process involves evaluating client side signals or asking a visitor to take minimal action such as checking a box. Challenges are designed to protect your application without introducing unnecessary friction. Most visitors will pass challenges automatically without interaction. Cloudflare does not use CAPTCHA puzzles or visual tests like selecting objects or typing distorted characters. All challenge types are lightweight, privacy-preserving, and optimized for real-world traffic. diff --git a/src/content/docs/cloudflare-challenges/reference/challenge-solve-rate.mdx b/src/content/docs/cloudflare-challenges/reference/challenge-solve-rate.mdx index 7cd631c99d697b9..c66c3ee3eff3561 100644 --- a/src/content/docs/cloudflare-challenges/reference/challenge-solve-rate.mdx +++ b/src/content/docs/cloudflare-challenges/reference/challenge-solve-rate.mdx @@ -2,7 +2,7 @@ pcx_content_type: reference title: Challenge solve rate (CSR) sidebar: - order: 1 + order: 2 --- import { Render } from "~/components" diff --git a/src/content/docs/cloudflare-challenges/reference/private-access-tokens.mdx b/src/content/docs/cloudflare-challenges/reference/private-access-tokens.mdx index fd99a983675e539..70322a5d4219c56 100644 --- a/src/content/docs/cloudflare-challenges/reference/private-access-tokens.mdx +++ b/src/content/docs/cloudflare-challenges/reference/private-access-tokens.mdx @@ -2,7 +2,7 @@ pcx_content_type: reference title: Private Access Tokens (PAT) sidebar: - order: 4 + order: 3 --- When a user is presented with a challenge page, Cloudflare decides what challenges need to be solved to prove they are human using results from the Private Access Token (PAT). If a user presents a token, they will have an easier time solving the challenge. diff --git a/src/content/docs/cloudflare-challenges/reference/supported-browsers.mdx b/src/content/docs/cloudflare-challenges/reference/supported-browsers.mdx index c7d2f276031fa9c..68a84dcfb5b4126 100644 --- a/src/content/docs/cloudflare-challenges/reference/supported-browsers.mdx +++ b/src/content/docs/cloudflare-challenges/reference/supported-browsers.mdx @@ -2,7 +2,7 @@ pcx_content_type: reference title: Supported browsers sidebar: - order: 2 + order: 4 --- When your application sends a challenge, your visitors either receive a non-interactive or an interactive challenge page. diff --git a/src/content/docs/cloudflare-challenges/reference/supported-languages.mdx b/src/content/docs/cloudflare-challenges/reference/supported-languages.mdx index 678dab2c576a4a3..89a110c2a0f71d3 100644 --- a/src/content/docs/cloudflare-challenges/reference/supported-languages.mdx +++ b/src/content/docs/cloudflare-challenges/reference/supported-languages.mdx @@ -9,7 +9,7 @@ sidebar: Cloudflare's challenges can detect multiple languages and display the localized challenge experience, which is determined by `navigator.language` value. The [Navigator.language read-only property](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/language) returns a string representing the preferred language of the user, usually the language of the browser user interface. -Refer to the table below for currently supported languages. +For language support specific to challenge pages, refer to the table below. | Language | Language code
(4 letters) | Language code
(2 letters) | | -------------------------------- | ----------------------------- | ----------------------------- | diff --git a/src/content/docs/cloudflare-challenges/troubleshooting/challenge-solve-issues.mdx b/src/content/docs/cloudflare-challenges/troubleshooting/challenge-solve-issues.mdx index 78e827137dcb686..e3f6a40f18dc373 100644 --- a/src/content/docs/cloudflare-challenges/troubleshooting/challenge-solve-issues.mdx +++ b/src/content/docs/cloudflare-challenges/troubleshooting/challenge-solve-issues.mdx @@ -2,7 +2,7 @@ title: Challenge solve issues pcx_content_type: troubleshooting sidebar: - order: 4 + order: 2 --- diff --git a/src/content/docs/cloudflare-challenges/troubleshooting/frequently-asked-questions.mdx b/src/content/docs/cloudflare-challenges/troubleshooting/frequently-asked-questions.mdx index b98746cf7fff1de..834458680744633 100644 --- a/src/content/docs/cloudflare-challenges/troubleshooting/frequently-asked-questions.mdx +++ b/src/content/docs/cloudflare-challenges/troubleshooting/frequently-asked-questions.mdx @@ -2,7 +2,7 @@ title: FAQ pcx_content_type: faq sidebar: - order: 2 + order: 3 --- ## Why am I being challenged on a Cloudflare-protected site? diff --git a/src/content/docs/turnstile/get-started/pre-clearance.mdx b/src/content/docs/turnstile/get-started/pre-clearance.mdx index 9b9fa4fa3374874..261bd2d40b16013 100644 --- a/src/content/docs/turnstile/get-started/pre-clearance.mdx +++ b/src/content/docs/turnstile/get-started/pre-clearance.mdx @@ -17,7 +17,7 @@ The prerequisite is crucial for pre-clearance to function properly. If set up co For more details on managing hostnames, refer to the [Hostname Management documentation](/turnstile/concepts/hostname-management/). - + ## Enable pre-clearance on a new site diff --git a/src/content/partials/bots/cf-clearance-cookie.mdx b/src/content/partials/cloudflare-challenges/cf-clearance-cookie.mdx similarity index 100% rename from src/content/partials/bots/cf-clearance-cookie.mdx rename to src/content/partials/cloudflare-challenges/cf-clearance-cookie.mdx diff --git a/src/content/partials/bots/javascript-detections-csp.mdx b/src/content/partials/cloudflare-challenges/javascript-detections-csp.mdx similarity index 100% rename from src/content/partials/bots/javascript-detections-csp.mdx rename to src/content/partials/cloudflare-challenges/javascript-detections-csp.mdx diff --git a/src/content/partials/bots/javascript-detections-definition.mdx b/src/content/partials/cloudflare-challenges/javascript-detections-definition.mdx similarity index 93% rename from src/content/partials/bots/javascript-detections-definition.mdx rename to src/content/partials/cloudflare-challenges/javascript-detections-definition.mdx index cdd8ca9a6b1e68b..b66a41a97f3e6aa 100644 --- a/src/content/partials/bots/javascript-detections-definition.mdx +++ b/src/content/partials/cloudflare-challenges/javascript-detections-definition.mdx @@ -1,16 +1,11 @@ --- -inputParameters: param1 - +{} --- import { Markdown } from "~/components" JavaScript detections are another method that help Cloudflare identify bot requests. -{props.one} - -## What are JavaScript detections? - These detections are implemented via a lightweight, invisible JavaScript code snippet that follows Cloudflare’s [privacy standards](https://www.cloudflare.com/privacypolicy/). JavaScript is injected only in response to requests for HTML pages or page views, excluding AJAX calls. API and mobile app traffic is unaffected. JavaScript detections have a lifespan of 15 minutes. However, the code is injected again before the session expires. After page load, the script is deferred and utilizes a separate thread (where available) to ensure that performance impact is minimal. The snippets of JavaScript will contain a source pointing to the challenge platform, with paths that start with `/cdn-cgi/challenge-platform/...` diff --git a/src/content/partials/bots/javascript-detections-enable.mdx b/src/content/partials/cloudflare-challenges/javascript-detections-enable.mdx similarity index 100% rename from src/content/partials/bots/javascript-detections-enable.mdx rename to src/content/partials/cloudflare-challenges/javascript-detections-enable.mdx diff --git a/src/content/partials/bots/javascript-detections-implementation.mdx b/src/content/partials/cloudflare-challenges/javascript-detections-implementation.mdx similarity index 85% rename from src/content/partials/bots/javascript-detections-implementation.mdx rename to src/content/partials/cloudflare-challenges/javascript-detections-implementation.mdx index 80a0a81fa31ec75..654aabe315e2cc6 100644 --- a/src/content/partials/bots/javascript-detections-implementation.mdx +++ b/src/content/partials/cloudflare-challenges/javascript-detections-implementation.mdx @@ -3,7 +3,7 @@ --- -Once you enable JavaScript detections, you can use the `cf.bot_management.js_detection.passed` field in WAF custom rules (or the `request.cf.botManagement.jsDetection.passed` variable in Workers). +Once you enable JavaScript detections, you can use the `cf.bot_management.js_detection.passed` field in [WAF custom rules](/waf/custom-rules/) (or the `request.cf.botManagement.jsDetection.passed` variable in [Workers](/workers/)). When adding this field to WAF custom rules, use it: @@ -14,7 +14,7 @@ When adding this field to WAF custom rules, use it: ### Prerequisites * You must have JavaScript detections enabled on your zone. -* You must have [updated your Content Security Policy headers](/bots/additional-configurations/javascript-detections/#if-you-have-a-content-security-policy-csp) for JavaScript detections. +* You must have [updated your Content Security Policy headers](/cloudflare-challenges/challenge-types/javascript-detections/#if-you-have-a-content-security-policy-csp) for JavaScript detections. * You must not run this field on websocket endpoints. * You must use the field in a custom rules expression that expects only browser traffic. * The action should always be a managed challenge in case a legitimate user has not received the challenge for network or browser reasons.