diff --git a/src/content/docs/byoip/service-bindings/cdn-and-spectrum.mdx b/src/content/docs/byoip/service-bindings/cdn-and-spectrum.mdx index 68ed13952d2c7ea..8b5a477609cc575 100644 --- a/src/content/docs/byoip/service-bindings/cdn-and-spectrum.mdx +++ b/src/content/docs/byoip/service-bindings/cdn-and-spectrum.mdx @@ -28,6 +28,7 @@ This guide will use the first example and consider a prefix that was onboarded t + ## Benefits @@ -49,4 +54,8 @@ If you cannot activate your domain using [proxied DNS records](/dns/proxy-status ## Additional support - + diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/hubspot.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/hubspot.mdx index 081bf4af26208bd..0d80a54b555a8c7 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/hubspot.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/hubspot.mdx @@ -9,11 +9,19 @@ description: Learn how to configure your zone with HubSpot. import { Render } from "~/components"; - + ## Benefits - + ## How it works @@ -50,4 +58,8 @@ Once the zone hold is temporarily disabled, follow HubSpot's instructions to ref ## Additional support - + diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/kinsta.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/kinsta.mdx index 19ced09cdbc7030..62bdbeceb16358a 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/kinsta.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/kinsta.mdx @@ -9,11 +9,19 @@ description: Learn how to configure your Enterprise zone with Kinsta. import { Render } from "~/components"; - + ## Benefits - + ## How it works @@ -38,7 +46,11 @@ To enable O2O for a specific hostname within a Cloudflare zone, [create](/dns/ma ## Additional support - + ### Resolving SSL errors using Cloudflare Managed Certificates diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/render.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/render.mdx index 1058f39b6ec8d6b..fd91e122f8de8a6 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/render.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/render.mdx @@ -11,6 +11,7 @@ import { Render } from "~/components"; @@ -62,7 +64,11 @@ If your root domain needs to route somewhere besides Render, add individual subd ## Additional support - + ### Resolving SSL errors diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/salesforce-commerce-cloud.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/salesforce-commerce-cloud.mdx index b866b0e608e97a9..d3577d0bfb6ff50 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/salesforce-commerce-cloud.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/salesforce-commerce-cloud.mdx @@ -11,6 +11,7 @@ import { Details, Render } from "~/components"; @@ -18,6 +19,7 @@ import { Details, Render } from "~/components"; @@ -81,6 +83,7 @@ And, the following is an **incorrect** configuration because `preview.example.co diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/shopify.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/shopify.mdx index 60f197716e05d76..7c1cca1a8173a91 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/shopify.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/shopify.mdx @@ -9,7 +9,11 @@ description: Learn how to configure your zone with Shopify. import { Render } from "~/components"; - + ## Benefits @@ -54,7 +58,11 @@ If you cannot activate your domain using [proxied DNS records](/dns/proxy-status ## Additional support - + ### DNS CAA records diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/wpengine.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/wpengine.mdx index b97946fee479989..ceafbf1bd41e2ef 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/wpengine.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/provider-guides/wpengine.mdx @@ -9,11 +9,19 @@ description: Learn how to configure your zone with WP Engine. import { Render } from "~/components"; - + ## Benefits - + ## How it works @@ -54,7 +62,11 @@ Once the zone hold is temporarily disabled, follow WP Engine's instructions to r ## Additional support - + ### Resolving SSL errors diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx index c6dbaca108e59b1..bd15818da533e7d 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx @@ -6,10 +6,9 @@ sidebar: head: - tag: title content: TLS Settings — Cloudflare for SaaS - --- -import { AvailableNotifications, Details, Render } from "~/components" +import { AvailableNotifications, Details, Render } from "~/components"; [Mutual TLS (mTLS)](https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/) adds an extra layer of protection to application connections by validating certificates on the server and the client. When building a SaaS application, you may want to enforce mTLS to protect sensitive endpoints related to payment processing, database updates, and more. @@ -17,7 +16,6 @@ import { AvailableNotifications, Details, Render } from "~/components" [Cipher suites](/ssl/edge-certificates/additional-options/cipher-suites/) are a combination of ciphers used to negotiate security settings during the [SSL/TLS handshake](https://www.cloudflare.com/learning/ssl/what-happens-in-a-tls-handshake/). As a SaaS provider, you can [specify configurations for cipher suites](#cipher-suites) on your zone as a whole and cipher suites on individual custom hostnames via the API. - :::caution When you [issue a custom hostname certificate](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/) with wildcards enabled, any cipher suites or Minimum TLS settings applied to that hostname will only apply to the direct hostname. @@ -30,10 +28,8 @@ Once you have [added a custom hostname](/cloudflare-for-platforms/cloudflare-for :::note - Currently, you cannot add mTLS policies for custom hostnames using [API Shield](/api-shield/security/mtls/). - ::: ## Enable Minimum TLS Version @@ -55,20 +51,21 @@ While TLS 1.3 is the most recent and secure version, it is not supported by some For security and regulatory reasons, you may want to only allow connections from certain cipher suites. Cloudflare provides recommended values and full cipher suite reference in our [Cipher suites documentation](/ssl/edge-certificates/additional-options/cipher-suites/#resources). -
Refer to [Customize cipher suites - SSL/TLS](/ssl/edge-certificates/additional-options/cipher-suites/customize-cipher-suites/).
-
In the API documentation, refer to [SSL properties of a custom hostname](/api/resources/custom_hostnames/methods/edit/). - - +
@@ -76,6 +73,9 @@ In the API documentation, refer to [SSL properties of a custom hostname](/api/re You can configure alerts to receive notifications before your mutual TLS certificates expire. - + diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/apex-proxying/setup.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/apex-proxying/setup.mdx index 35caf3921c8d921..b03d28178f1017d 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/apex-proxying/setup.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/apex-proxying/setup.mdx @@ -16,6 +16,7 @@ To set up Cloudflare for SaaS for [apex proxying](/cloudflare-for-platforms/clou + --- diff --git a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/atlassian-confluence.mdx b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/atlassian-confluence.mdx index b5d8a9b675d8c97..8ee094ea7a0cf94 100644 --- a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/atlassian-confluence.mdx +++ b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/atlassian-confluence.mdx @@ -7,11 +7,12 @@ rss: file import { Render } from "~/components"; :::note @@ -42,8 +43,12 @@ These permissions follow the principle of least privilege to ensure that only th ## Security findings ### Access security diff --git a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/atlassian-jira.mdx b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/atlassian-jira.mdx index 2ed30e254ee025b..02331e5b3ea6ce2 100644 --- a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/atlassian-jira.mdx +++ b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/atlassian-jira.mdx @@ -7,8 +7,12 @@ rss: file import { Render } from "~/components"; :::note @@ -34,8 +38,9 @@ These permissions follow the principle of least privilege to ensure that only th ## Security findings ### Access security diff --git a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/aws-s3.mdx b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/aws-s3.mdx index 2aab0aa70d35308..169fb868b747ea7 100644 --- a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/aws-s3.mdx +++ b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/aws-s3.mdx @@ -8,6 +8,7 @@ import { Render } from "~/components"; diff --git a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/bitbucket-cloud.mdx b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/bitbucket-cloud.mdx index 7f753b123913288..6a06403679fbe2f 100644 --- a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/bitbucket-cloud.mdx +++ b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/bitbucket-cloud.mdx @@ -7,8 +7,12 @@ rss: file import { Render } from "~/components"; :::note @@ -45,8 +49,12 @@ These permissions follow the principle of least privilege to ensure that only th ## Security findings ### Repository security diff --git a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/box.mdx b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/box.mdx index b2797c19700bb64..e273861f22d16bb 100644 --- a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/box.mdx +++ b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/box.mdx @@ -8,6 +8,7 @@ import { Render } from "~/components"; @@ -29,6 +30,7 @@ These permissions follow the principle of least privilege to ensure that only th diff --git a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/dropbox.mdx b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/dropbox.mdx index 5c57e83446d4aa3..133eb3aac1018f7 100644 --- a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/dropbox.mdx +++ b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/dropbox.mdx @@ -8,6 +8,7 @@ import { Render } from "~/components"; diff --git a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/gcp-cloud-storage.mdx b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/gcp-cloud-storage.mdx index 6783305cd2e95bb..4f4b6c24b177969 100644 --- a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/gcp-cloud-storage.mdx +++ b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/gcp-cloud-storage.mdx @@ -8,6 +8,7 @@ import { Render } from "~/components"; ## Integration prerequisites @@ -35,8 +39,9 @@ These permissions follow the principle of least privilege to ensure that only th ## Security findings ### Branches and merges diff --git a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/google-workspace/gmail-fedramp.mdx b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/google-workspace/gmail-fedramp.mdx index 6be2ff44db05b07..741b1e02c2cbbf0 100644 --- a/src/content/docs/cloudflare-one/applications/casb/casb-integrations/google-workspace/gmail-fedramp.mdx +++ b/src/content/docs/cloudflare-one/applications/casb/casb-integrations/google-workspace/gmail-fedramp.mdx @@ -10,6 +10,7 @@ import { Render } from "~/components"; ## Integration prerequisites @@ -30,7 +34,11 @@ These permissions follow the principle of least privilege to ensure that only th ## Security findings - + ### User account settings diff --git a/src/content/docs/cloudflare-one/applications/configure-apps/saas-apps/generic-oidc-saas.mdx b/src/content/docs/cloudflare-one/applications/configure-apps/saas-apps/generic-oidc-saas.mdx index 0af309593f85d01..c0cf043b7daa4f7 100644 --- a/src/content/docs/cloudflare-one/applications/configure-apps/saas-apps/generic-oidc-saas.mdx +++ b/src/content/docs/cloudflare-one/applications/configure-apps/saas-apps/generic-oidc-saas.mdx @@ -3,17 +3,16 @@ pcx_content_type: how-to title: Generic OIDC application sidebar: order: 1 - --- -import { Render } from "~/components" +import { Render } from "~/components"; This page provides generic instructions for setting up a SaaS application in Cloudflare Access using the OpenID Connect (OIDC) authentication protocol. ## Prerequisites -* An [identity provider](/cloudflare-one/identity/idp-integration/) configured in Cloudflare Zero Trust -* Admin access to the account of the SaaS application +- An [identity provider](/cloudflare-one/identity/idp-integration/) configured in Cloudflare Zero Trust +- Admin access to the account of the SaaS application ## 1. Get SaaS application URL @@ -42,16 +41,16 @@ Some SaaS applications provide the Redirect URL after you [configure the SSO pro 9. (Optional) Enable [Proof of Key Exchange (PKCE)](https://www.oauth.com/oauth2-servers/pkce/) if the protocol is supported by your IdP. PKCE will be performed on all login attempts. 10. Copy the following values to input into your SaaS application. Different SaaS applications may require different sets of input values. - | Field | Description | + | Field | Description | | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | Client secret | Credential used to authorize Access as an SSO provider | - | Client ID | Unique identifier for this Access application | + | Client secret | Credential used to authorize Access as an SSO provider | + | Client ID | Unique identifier for this Access application | | Configuration endpoint | If supported by your SaaS application, you can configure OIDC using this endpoint instead of manually entering the URLs listed below.
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc//.well-known/openid-configuration` | - | Issuer | Base URL for this OIDC integration
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc/` | - | Token endpoint | Returns the user's ID token
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc//token` | - | Authorization endpoint | URL where users authenticate with Access
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc//authorization` | - | Key endpoint | Returns the current public keys used to [verify the Access JWT](/cloudflare-one/identity/authorization-cookie/validating-json/)
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc//jwks` | - | User info endpoint | Returns all user claims in JSON format
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc//userinfo` | + | Issuer | Base URL for this OIDC integration
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc/` | + | Token endpoint | Returns the user's ID token
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc//token` | + | Authorization endpoint | URL where users authenticate with Access
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc//authorization` | + | Key endpoint | Returns the current public keys used to [verify the Access JWT](/cloudflare-one/identity/authorization-cookie/validating-json/)
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc//jwks` | + | User info endpoint | Returns all user claims in JSON format
`https://.cloudflareaccess.com/cdn-cgi/access/sso/oidc//userinfo` | 11. @@ -77,12 +76,12 @@ Open an incognito browser window and go to the SaaS application's login URL. You OIDC claims refer to the user identity characteristics that Cloudflare Access shares with your OIDC SaaS application upon successful authentication. An OIDC scope defines a set of OIDC claims. By default, Cloudflare Access passes all [standard claims](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) that are included in the `openid`, `email`, `profile`, and `groups` scopes (if available). - | Scope | Description | - | --------- | ---------------------------------------------------- | - | `openid` | Includes a unique identifier for the user (required). | - | `email` | Includes the user's email address. | - | `profile` | Includes the user's name and all custom OIDC claims from the IdP. | - | `groups` | Include the user's IdP group membership. | +| Scope | Description | +| --------- | ----------------------------------------------------------------- | +| `openid` | Includes a unique identifier for the user (required). | +| `email` | Includes the user's email address. | +| `profile` | Includes the user's name and all custom OIDC claims from the IdP. | +| `groups` | Include the user's IdP group membership. | In your Access application, you can configure the OIDC scopes and claims that Access sends to the SaaS provider. For example, you can remove the `groups` scope if your SaaS application does not need to receive user group information. @@ -94,11 +93,11 @@ In **Group filter regex**, you can enter a regular expression to define the iden To add additional OIDC claims onto the ID token sent to your SaaS application, configure the following fields for each claim: - - **Name**: OIDC claim name - - **Scope**: Select the OIDC scope where this claim should be included. In most cases, we recommend selecting `profile` since it already includes other custom claims from the IdP. - - **IdP claim**: The identity provider value that should map to this OIDC claim. You can select any [SAML attribute](/cloudflare-one/identity/idp-integration/generic-saml/#saml-headers-and-attributes) or [OIDC claim](/cloudflare-one/identity/idp-integration/generic-oidc/#custom-oidc-claims) that was configured in a Zero Trust IdP integration. - - **Required**: If a claim is marked as required but is not provided by an IdP, Cloudflare will fail the authentication request and show an error page. - - **Add per IdP claim**: (Optional) If you turned on multiple identity providers for the SaaS application, you can choose different attribute mappings for each IdP. These values will override the parent **IdP claim**. + - **Name**: OIDC claim name + - **Scope**: Select the OIDC scope where this claim should be included. In most cases, we recommend selecting `profile` since it already includes other custom claims from the IdP. + - **IdP claim**: The identity provider value that should map to this OIDC claim. You can select any [SAML attribute](/cloudflare-one/identity/idp-integration/generic-saml/#saml-headers-and-attributes) or [OIDC claim](/cloudflare-one/identity/idp-integration/generic-oidc/#custom-oidc-claims) that was configured in a Zero Trust IdP integration. + - **Required**: If a claim is marked as required but is not provided by an IdP, Cloudflare will fail the authentication request and show an error page. + - **Add per IdP claim**: (Optional) If you turned on multiple identity providers for the SaaS application, you can choose different attribute mappings for each IdP. These values will override the parent **IdP claim**. ## Advanced settings @@ -107,7 +106,12 @@ To add additional OIDC claims onto the ID token sent to your SaaS application, c The OIDC Access token authorizes users to connect to the SaaS application through Cloudflare Access. You can set an **Access token lifetime** to determine the window in which the token can be used to establish authentication with the SaaS application — if it expires, the user must re-authenticate through Cloudflare Access. To balance security and user convenience, Cloudflare recommends configuring a short Access token lifetime in conjunction with a longer **Refresh token lifetime** (if supported by your application). When the access token expires, Cloudflare will use the refresh token to obtain a new access token after checking the user's identity against your Access policies. When the refresh token expires, the user will need to log back in to the identity provider. The refresh token lifetime should be less than your [global session duration](/cloudflare-one/identity/users/session-management/), otherwise the global session would take precedence. :::note - + + ::: ### OIDC flows @@ -121,10 +125,10 @@ Some SaaS applications require SSO providers to provide tokens to the browser wi Cloudflare allows various `response_type` values in the authorization request depending on the selected flow. For example, the implicit flow allows Cloudflare to return the ID token, Access token, or both the ID token and Access token from the Authorization endpoint. | `response_type` values | Default flow | Hybrid flow | Implicit flow | -| -------------- | -- | -- | -- | -| `code` | ✅ | ✅ | ❌ | -| `id_token` | ❌ |✅ | ✅ | -| `token` | ❌| ✅ |✅ | +| ---------------------- | ------------ | ----------- | ------------- | +| `code` | ✅ | ✅ | ❌ | +| `id_token` | ❌ | ✅ | ✅ | +| `token` | ❌ | ✅ | ✅ | To include `id_token` in the authorization request, turn on **Return ID Token from Authorization Endpoint**. To include `token`, turn on **Return Access Token from Authorization Endpoint** diff --git a/src/content/docs/cloudflare-one/applications/configure-apps/saas-apps/miro-saas.mdx b/src/content/docs/cloudflare-one/applications/configure-apps/saas-apps/miro-saas.mdx index 6b9b3855e334ee4..d3da69cbb8331dd 100644 --- a/src/content/docs/cloudflare-one/applications/configure-apps/saas-apps/miro-saas.mdx +++ b/src/content/docs/cloudflare-one/applications/configure-apps/saas-apps/miro-saas.mdx @@ -4,18 +4,17 @@ title: Miro reviewed: 2024-07-25 sidebar: order: 19 - --- -import { Render, TabItem, Tabs } from "~/components" +import { Render, TabItem, Tabs } from "~/components"; This guide covers how to configure [Miro](https://help.miro.com/hc/articles/360017571414-Single-sign-on-SSO) as a SAML application in Cloudflare Zero Trust. ## Prerequisites -* An [identity provider](/cloudflare-one/identity/idp-integration/) configured in Cloudflare Zero Trust -* Admin access to a Miro Business or Enterprise plan account -* A [verified domain](https://help.miro.com/hc/articles/360034831793-Domain-control) added to your Miro account (Enterprise plan), or be prepared to do so during SSO configuration (Business or Enterprise plan) +- An [identity provider](/cloudflare-one/identity/idp-integration/) configured in Cloudflare Zero Trust +- Admin access to a Miro Business or Enterprise plan account +- A [verified domain](https://help.miro.com/hc/articles/360034831793-Domain-control) added to your Miro account (Enterprise plan), or be prepared to do so during SSO configuration (Business or Enterprise plan) ## 1. Add a SaaS application to Cloudflare Zero Trust @@ -25,9 +24,9 @@ This guide covers how to configure [Miro](https://help.miro.com/hc/articles/3600 4. For the authentication protocol, select **SAML**. 5. Select **Add application**. 6. Fill in the following fields: - * **Entity ID**: `https://miro.com/` - * **Assertion Consumer Service URL**: `https://miro.com/sso/saml` - * **Name ID format**: *Email* + - **Entity ID**: `https://miro.com/` + - **Assertion Consumer Service URL**: `https://miro.com/sso/saml` + - **Name ID format**: _Email_ 7. Copy the **SSO endpoint** and **Public key**. 8. Configure [Access policies](/cloudflare-one/policies/access/) for the application. 9. Save the application. @@ -36,19 +35,30 @@ This guide covers how to configure [Miro](https://help.miro.com/hc/articles/3600 - + - **Authentication** > **Single sign-on**", two: "If you have not previously [verified the domain](https://help.miro.com/hc/articles/360034831793-Domain-control), enter" }} /> + **Authentication** > **Single sign-on**", + two: "If you have not previously [verified the domain](https://help.miro.com/hc/articles/360034831793-Domain-control), enter", + }} +/> ## 3. Test the integration -In the Miro SAML/SSO configuration page, select **Test SSO Configuration**. You will be redirected to the Cloudflare Access login screen and prompted to sign in with your identity provider. If the login is successful, you will receive a **SSO configuration test was successful** message. +In the Miro SAML/SSO configuration page, select **Test SSO Configuration**. You will be redirected to the Cloudflare Access login screen and prompted to sign in with your identity provider. If the login is successful, you will receive a **SSO configuration test was successful** message. :::note When testing the integration, you do not have to use an email from a domain you have configured for SSO or a user configured in Miro. The only requirement is that the user is already configured in your identity provider. diff --git a/src/content/docs/cloudflare-one/applications/non-http/infrastructure-apps.mdx b/src/content/docs/cloudflare-one/applications/non-http/infrastructure-apps.mdx index f2e1039f72cdf3a..5bee19351fda592 100644 --- a/src/content/docs/cloudflare-one/applications/non-http/infrastructure-apps.mdx +++ b/src/content/docs/cloudflare-one/applications/non-http/infrastructure-apps.mdx @@ -37,7 +37,11 @@ Access for Infrastructure currently only supports [SSH](/cloudflare-one/connecti ## 1. Add a target - + ## 2. Add an infrastructure application diff --git a/src/content/docs/cloudflare-one/applications/non-http/short-lived-certificates-legacy.mdx b/src/content/docs/cloudflare-one/applications/non-http/short-lived-certificates-legacy.mdx index 870e3ca1548ed45..26d040ba1cc4366 100644 --- a/src/content/docs/cloudflare-one/applications/non-http/short-lived-certificates-legacy.mdx +++ b/src/content/docs/cloudflare-one/applications/non-http/short-lived-certificates-legacy.mdx @@ -14,6 +14,7 @@ Not recommended for new deployments. We recommend using [Access for Infrastructu diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate.mdx b/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate.mdx index c4a4a391671d07a..926ed6d906508b2 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/custom-certificate.mdx @@ -78,7 +78,11 @@ openssl x509 -in .pem -text -1. +1. 2. Set the certificate as available for use in inspection with the [Activate a Zero Trust certificate endpoint](/api/resources/zero_trust/subresources/gateway/subresources/certificates/methods/activate/). This will deploy the certificate across the Cloudflare global network. diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment.mdx b/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment.mdx index ff1ad1e5ac715cf..40af19b24b00564 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment.mdx @@ -119,7 +119,11 @@ To install a Cloudflare certificate in macOS, you can use either the Keychain Ac 1. Download a Cloudflare certificate. - + The root certificate is now installed and ready to be used. @@ -264,6 +268,7 @@ ChromeOS devices use different methods to store and deploy root certificates. Ce @@ -277,6 +282,7 @@ ChromeOS devices use different methods to store and deploy root certificates. Ce CA certificate" }} /> @@ -517,7 +523,6 @@ To install a certificate for use in a Docker container: To add the certificate to your Dockerfile to install it during the build process: - 1. Add the certificate install directions to your Dockerfile. For example: ```docker title="Red Hat-based images" @@ -576,7 +581,6 @@ To install a certificate for use in a Docker container: To add the certificate to your Docker Compose file to install it during runtime: - 1. Add the certificate install directions to your `docker-compose.yml` file. For example: ```yaml title="Red Hat-based containers" @@ -843,7 +847,6 @@ To install a Cloudflare root certificate on Eclipse IDE for Java Developers, you 1. [Download a Cloudflare certificate](#download-the-cloudflare-root-certificate). 2. Find the `java.home` value for your Eclipse installation. - 1. In Eclipse, go to **Eclipse** > **About Eclipse** (or **Help** > **About Eclipse IDE** on Windows and Linux) 2. Select **Installation Details**, then go to **Configuration**. 3. Search for `java.home`, then locate the value. For example: diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles.mdx b/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles.mdx index 13e1f80034cb04f..aa215041de67e5e 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles.mdx @@ -137,7 +137,11 @@ You can configure device profiles to match against the following selectors, or c Apply a device profile based on the user's email. - + ### User group emails @@ -145,6 +149,7 @@ Apply a device profile based on an [IdP group](/cloudflare-one/policies/gateway/ @@ -154,6 +159,7 @@ Apply a device profile based on an [IdP group](/cloudflare-one/policies/gateway/ @@ -163,6 +169,7 @@ Apply a device profile based on an [IdP group](/cloudflare-one/policies/gateway/ diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx b/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx index 0263654c5e46e52..e3d720f1a2b11d0 100644 --- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/firewall.mdx @@ -17,6 +17,7 @@ The WARP client connects to Cloudflare via a standard HTTPS connection outside t .cloudflare-gateway.com", }} @@ -105,6 +107,7 @@ The client connects to the following destinations to verify general Internet con @@ -17,25 +15,24 @@ import { Details, Render, TabItem, Tabs } from "~/components" | System | Availability | Minimum WARP version | | -------- | ------------ | -------------------- | -| Windows | ✅ | 2024.1.159.0 | -| macOS | ✅ | 2024.1.160.0 | -| Linux | ✅ | 2024.2.62.0 | -| iOS | ✅ | 1.7 | -| Android | ✅ | 1.4 | -| ChromeOS | ✅ | 1.4 | - +| Windows | ✅ | 2024.1.159.0 | +| macOS | ✅ | 2024.1.160.0 | +| Linux | ✅ | 2024.2.62.0 | +| iOS | ✅ | 1.7 | +| Android | ✅ | 1.4 | +| ChromeOS | ✅ | 1.4 | In Cloudflare WARP, users can switch between multiple Zero Trust organizations (or other [MDM parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/)) that administrators specify in an MDM file. Common use cases include: -* Allow IT security staff to switch between test and production environments. -* Allow Managed Service Providers to support multiple customer accounts. -* Allow users to switch between the default WARP ingress IPs and the [Cloudflare China ingress IPs](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#override_warp_endpoint). +- Allow IT security staff to switch between test and production environments. +- Allow Managed Service Providers to support multiple customer accounts. +- Allow users to switch between the default WARP ingress IPs and the [Cloudflare China ingress IPs](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/#override_warp_endpoint). ## MDM file format -To enable multiple organizations, administrators need to modify their [MDM file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) to take an array of configurations. Each configuration must include a `display_name` parameter that will be visible to users in the WARP client GUI. Because display names are listed in the same order as they appear in the MDM file, we recommend putting the most used configurations at the top of the file. When a user opens the WARP client for the first time, they will be prompted to log into the first configuration in the list. +To enable multiple organizations, administrators need to modify their [MDM file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) to take an array of configurations. Each configuration must include a `display_name` parameter that will be visible to users in the WARP client GUI. Because display names are listed in the same order as they appear in the MDM file, we recommend putting the most used configurations at the top of the file. When a user opens the WARP client for the first time, they will be prompted to log into the first configuration in the list. An MDM file supports a maximum of 25 configurations. The following example includes three configurations. @@ -85,10 +82,18 @@ An MDM file supports a maximum of 25 configurations. The following example inclu - Account" }} /> + Account" }} +/> - Advanced.", two: "Settings > Account" }} /> + Advanced.", two: "Settings > Account" }} +/> diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/aws.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/aws.mdx index bb76956a029144d..bb98c0a8f79a2bb 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/aws.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/aws.mdx @@ -86,6 +86,7 @@ EOF diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/google-cloud-platform.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/google-cloud-platform.mdx index 68a993e59decf81..9bcfa02d6097203 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/google-cloud-platform.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/google-cloud-platform.mdx @@ -64,6 +64,7 @@ To complete the following procedure, you will need to: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/index.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/index.mdx index 1c2fa7631bf3c69..660290b0146afd4 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/index.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/private-net/cloudflared/index.mdx @@ -31,6 +31,7 @@ To connect your infrastructure with Cloudflare Tunnel: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/grpc.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/grpc.mdx index 584de13ccd4e337..f93922040d72ad4 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/grpc.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/grpc.mdx @@ -40,6 +40,7 @@ To establish a secure, outbound-only connection to Cloudflare: diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser.mdx index 744b8e1d6d1f54b..f2c9b51ebdd98f4 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser.mdx @@ -36,7 +36,11 @@ Browser-based RDP can be used in conjunction with [routing over WARP](/cloudflar ## 2. Add a target - + ## 3. Create a DNS record diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx index 8a190f2edeb15fd..4610ce4f3f1814b 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-warp-to-tunnel.mdx @@ -64,6 +64,7 @@ By default, Internet Explorer will be installed and configured in [Enhanced Secu diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx index d4abd6092aee75b..b159cdd9b6a0511 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/smb.mdx @@ -38,6 +38,7 @@ You can use Cloudflare Tunnel to create a secure, outbound-only connection from ### 4. Connect as a user diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx index a994158b8b36502..29525790ac3911f 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx @@ -12,6 +12,7 @@ import { Tabs, TabItem, Badge, Render, APIRequest } from "~/components"; @@ -34,11 +35,19 @@ To connect your devices to Cloudflare: ## 3. Route server IPs through WARP - + ## 4. Add a target - + ## 5. Add an infrastructure application @@ -107,7 +116,11 @@ Follow these instructions to encrypt and download SSH command logs from Zero Tru #### Enable SSH command logging - + #### Disable SSH command logging diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx index d69daf3f974ec4e..2aeb48e4d30fee5 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel.mdx @@ -73,6 +73,7 @@ In order to be able to establish an SSH connection, do not enable [OS Login](htt diff --git a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-email-security-mx.mdx b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-email-security-mx.mdx index fb610d5ab1f59f2..ab00b2649222403 100644 --- a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-email-security-mx.mdx +++ b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-email-security-mx.mdx @@ -5,13 +5,16 @@ sidebar: order: 5 --- -import { Render } from "~/components" +import { Render } from "~/components"; ![A schematic showing where Email Security sits in the life cycle of an email received](~/assets/images/email-security/deployment/inline-setup/Cisco_to_Email_Security_MX_Inline.png) -In this tutorial, you will learn how to configure Cisco IronPort with Email Security as MX record. +In this tutorial, you will learn how to configure Cisco IronPort with Email Security as MX record. - + ## 1. Add a Sender Group for Email Security Email Protection IPs @@ -52,4 +55,7 @@ Refer to [Cisco's documentation](https://www.cisco.com/c/en/us/support/docs/secu ## 4. Set up MX/Inline - \ No newline at end of file + diff --git a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-mx.mdx b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-mx.mdx index 5a455c9acaf2074..060e8ebd136b009 100644 --- a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-mx.mdx +++ b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-mx.mdx @@ -5,11 +5,11 @@ sidebar: order: 6 --- -import { GlossaryTooltip, Render } from "~/components" +import { GlossaryTooltip, Render } from "~/components"; ![A schematic showing where Email Security is in the life cycle of an email received](src/assets/email-security/Cisco_to_Cisco_MX_Inline.png) -In this tutorial, you will learn how to configure Email Security with Cisco as MX record. +In this tutorial, you will learn how to configure Email Security with Cisco as MX record. ## 1. Add a Sender Group for Email Security Email Protection IPs @@ -46,8 +46,8 @@ To add a new SMTP Route: To manage the mail flow between Email Security and Cisco ESA, you need two filters: -* One to direct all incoming messages to Email Security. -* One to recognize messages coming back from Email Security to route for normal delivery. +- One to direct all incoming messages to Email Security. +- One to recognize messages coming back from Email Security to route for normal delivery. ### Incoming Content Filter - To Email Security @@ -80,21 +80,20 @@ To create a new Content Filter: - **Order**: This filter must come before the previously created filter. - **Conditions**: Add conditions of type **Remote IP/Hostname** with all the IP addresses mentioned in Egress IPs. For example: - | Order | Condition | Rule | - | ----- | -------------------- | -------------------- | - | `1` | `Remote IP/Hostname` | `Remote IP/Hostname` | - | `2` | `Remote IP/Hostname` | `52.89.255.11` | - | `3` | `Remote IP/Hostname` | `52.0.67.109` | - | `4` | `Remote IP/Hostname` | `54.173.50.115` | - | `5` | `Remote IP/Hostname` | `104.30.32.0/19` | - | `6` | `Remote IP/Hostname` | `158.51.64.0/26` | - | `7` | `Remote IP/Hostname` | `158.51.65.0/26` | - - - Ensure that the *Apply rule:* dropdown is set to **If one or more conditions match**. + | Order | Condition | Rule | + | ----- | -------------------- | -------------------- | + | `1` | `Remote IP/Hostname` | `Remote IP/Hostname` | + | `2` | `Remote IP/Hostname` | `52.89.255.11` | + | `3` | `Remote IP/Hostname` | `52.0.67.109` | + | `4` | `Remote IP/Hostname` | `54.173.50.115` | + | `5` | `Remote IP/Hostname` | `104.30.32.0/19` | + | `6` | `Remote IP/Hostname` | `158.51.64.0/26` | + | `7` | `Remote IP/Hostname` | `158.51.65.0/26` | + - Ensure that the _Apply rule:_ dropdown is set to **If one or more conditions match**. - **Actions**: Select **Add Action**, and add the following: - | Order | Action | Rule | + | Order | Action | Rule | | ----- | ----------------------------------------------- | ---------------- | - | --1 | `Skip Remaining Content Filters (Final Action)` | `skip-filters()` | + | --1 | `Skip Remaining Content Filters (Final Action)` | `skip-filters()` | ## 4. Add the Incoming Content Filter to the Inbound Policy table @@ -102,8 +101,11 @@ Assign the Incoming Content Filters created in [step 3](#3-create-incoming-conte ## 5. Geographic locations - + ## 6. Set up MX/Inline - \ No newline at end of file + diff --git a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/gsuite-email-security-mx.mdx b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/gsuite-email-security-mx.mdx index b2f85de6d8fe75f..8c717a6f26b6e00 100644 --- a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/gsuite-email-security-mx.mdx +++ b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/gsuite-email-security-mx.mdx @@ -5,13 +5,16 @@ sidebar: order: 4 --- -import { Render, GlossaryTooltip } from "~/components" +import { Render, GlossaryTooltip } from "~/components"; ![A schematic showing where Email Security is in the life cycle of an email received](src/assets/email-security/Email_Security_Gmail_MX_Inline.png) In this tutorial, you will learn how to configure Google Workspace with Email Security as MX record. - + ## Requirements @@ -22,37 +25,40 @@ In this tutorial, you will learn how to configure Google Workspace with Email Se ## 1. Set up Inbound Email Configuration Set up [Inbound Email Configuration](https://support.google.com/a/answer/60730?hl=en) with the following details: - - In **Gateway IPs**, select the **Add** link, and add the IPs mentioned in [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/). - - Select **Automatically detect external IP (recommended)**. - - Select **Require TLS for connections from the email gateways listed above**. - - Do not select **Reject all mail not from gateway IPs**. You will enable this option at a later time to ensure your mail flows. - - Select **SAVE**. + +- In **Gateway IPs**, select the **Add** link, and add the IPs mentioned in [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/). +- Select **Automatically detect external IP (recommended)**. +- Select **Require TLS for connections from the email gateways listed above**. +- Do not select **Reject all mail not from gateway IPs**. You will enable this option at a later time to ensure your mail flows. +- Select **SAVE**. ## 2. (Optional) Set up an email quarantine -[Set up an email quarantine](https://support.google.com/a/answer/6104172?hl=en#:~:text=Sign%20in%20with%20an%20administrator,t%20access%20the%20Admin%20console.&text=Manage%20quarantines.,Click%20Add%20Quarantine.) with the following details: - - **Name**: Email Security Malicious. - - **Description**: Email Security Malicious. - - For the **Inbound denial consequence**, select **Drop message**. - - For the **Outbound denial consequence**, select **Drop message**. - - Select **SAVE**. +[Set up an email quarantine](https://support.google.com/a/answer/6104172?hl=en#add-new-quarantine) with the following details: + +- **Name**: Email Security Malicious. +- **Description**: Email Security Malicious. +- For the **Inbound denial consequence**, select **Drop message**. +- For the **Outbound denial consequence**, select **Drop message**. +- Select **SAVE**. To access the newly created quarantine, select **GO TO ADMIN QUARANTINE** or access the quarantine directly by pointing your browser to https://email-quarantine.google.com/adminreview. ## 3. (Optional) Create a content compliance filter Go to **Compliance**, and create a [content compliance filter](https://support.google.com/a/answer/1346934?hl=en#zippy=%2Cstep-go-to-gmail-compliance-settings-in-the-google-admin-console%2Cstep-enter-email-messages-to-affect) to send malicious messages to quarantine. Enter the following details: - - **Content compliance**: Add `Quarantine Email Security Malicious`. - - **Email messages to affect**: Select **Inbound**. - - **Add expressions that describe the content you want to search for in each message**: - - Select **Add** to add the condition. - - In **Simple content match**, select **Advanced content match**. - - In **Location**, select **Full headers**. - - In **Match type**, select **Contains text**. - - In **Content**, enter `X-CFEmailSecurity-Disposition: MALICIOUS`. - - Select **SAVE** to save the condition. - - If the above expression match, do the following, select **Quarantine message** and the **Email Security Malicious** quarantine that was created in the previous step. - - Select **SAVE**. + +- **Content compliance**: Add `Quarantine Email Security Malicious`. +- **Email messages to affect**: Select **Inbound**. +- **Add expressions that describe the content you want to search for in each message**: + - Select **Add** to add the condition. + - In **Simple content match**, select **Advanced content match**. + - In **Location**, select **Full headers**. + - In **Match type**, select **Contains text**. + - In **Content**, enter `X-CFEmailSecurity-Disposition: MALICIOUS`. + - Select **SAVE** to save the condition. +- If the above expression match, do the following, select **Quarantine message** and the **Email Security Malicious** quarantine that was created in the previous step. +- Select **SAVE**. If you would like to quarantine the other dispositions, repeat the above steps and use the following strings for the other dispositions: @@ -64,7 +70,10 @@ If desired, you can create a separate quarantine for each of the dispositions. ## 4. Set up MX/Inline - + ## 5. (Recommended) Secure Google Workspace from MX records bypass @@ -84,4 +93,4 @@ After 72 hours, the MX record DNS update will have sufficiently propagated acros 4. Enable **Reject all mail not from gateway IPs** and select **Save**. -5. Select **Save** once more to commit and activate the configuration change in the Gmail advanced configuration console. \ No newline at end of file +5. Select **Save** once more to commit and activate the configuration change in the Gmail advanced configuration console. diff --git a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/index.mdx b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/index.mdx index e60e7d369acb47d..a150fb7a0b3c1b3 100644 --- a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/index.mdx +++ b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/index.mdx @@ -5,13 +5,16 @@ sidebar: order: 3 --- -import { Render, Markdown, GlossaryTooltip } from "~/components" +import { Render, Markdown, GlossaryTooltip } from "~/components"; ![A schematic showing where Email Security is in the life cycle of an email received](src/assets/email-security/Email_Security_O365_MXInline.png) In this tutorial, you will learn how to configure Microsoft 365 with Email Security as its MX record. - + ## 1. Add Email Security IP addresses to Allow List @@ -19,20 +22,20 @@ In this tutorial, you will learn how to configure Microsoft 365 with Email Secur 2. In **Always allow messages from the following IP addresses or address range**, add IP addresses and CIDR blocks mentioned in Egress IPs. 3. Select **Save**. 4. Microsoft recommends disabling SPF Hard fail when an email solution is placed in front of it: - - Return to the [Anti-spam option](https://security.microsoft.com/antispam). - - Select **Default anti-spam policy**. - - Select **[Edit spam threshold and properties](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)** > **Mark as spam** > **SPF record: hard fail**, and ensure it is set to **Off**. + - Return to the [Anti-spam option](https://security.microsoft.com/antispam). + - Select **Default anti-spam policy**. + - Select **[Edit spam threshold and properties](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)** > **Mark as spam** > **SPF record: hard fail**, and ensure it is set to **Off**. 5. Select **Save**. ## 2. Configure Enhanced Filtering ### Create an inbound connector -1. [Set up a connector](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail#1-set-up-a-connector-from-your-email-server-to-microsoft-365-or-office-365). +1. [Set up a connector](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail#1-set-up-a-connector-from-your-email-server-to-microsoft-365-or-office-365). 2. Select **Partner organization** under **Connection from**. - - Provide a name for the connector: - - **Name**: ```Email Security Inbound Connector``` - - **Description**: ```Inbound connector for Enhanced Filtering``` + - Provide a name for the connector: + - **Name**: `Email Security Inbound Connector` + - **Description**: `Inbound connector for Enhanced Filtering` 3. In **Authenticating sent email**, select **By verifying that the IP address of the sending server matches one of the following IP addresses, which belongs to your partner organization.** 4. Enter all of the egress IPs in the [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/) page. 5. In **Security restrictions**, accept the default **Reject email messages if they aren't sent over TLS** setting. @@ -56,15 +59,17 @@ To configure anti-spam policies: 5. Select the **Anti-spam inbound policy (Default)** text (not the checkbox). 6. In **Actions**, scroll down and select **Edit actions**. 7. Set the following conditions and actions (you might need to scroll up or down to find them): -- **Spam**: *Move messages to Junk Email folder*. -- **High confidence spam**: *Quarantine message*. + +- **Spam**: _Move messages to Junk Email folder_. +- **High confidence spam**: _Quarantine message_. - **Select quarantine policy**: _AdminOnlyAccessPolicy_. -- **Phishing**: *Quarantine message*. +- **Phishing**: _Quarantine message_. - **Select quarantine policy**: _AdminOnlyAccessPolicy_. -- **High confidence phishing**: *Quarantine message*. +- **High confidence phishing**: _Quarantine message_. - **Select quarantine policy**: _AdminOnlyAccessPolicy_. - **Retain spam in quarantine for this many days**: Default is 15 days. Email Security recommends 15-30 days. - Select the spam actions in the above step: + 8. Select **Save**. ## 4. Create transport rules @@ -75,13 +80,12 @@ To create the transport rules that will send emails with certain [dispositions]( 2. Go to **Mail flow** > **Rules**. 3. Select **Add a Rule** > **Create a new rule**. 4. Set the following rule conditions: - - **Name**: _Email Security Deliver to Junk Email folder_. - - **Apply this rule if**: *The message headers* > *includes any of these words*. + - **Apply this rule if**: _The message headers_ > _includes any of these words_. - **Enter text**: `X-CFEmailSecurity-Disposition` > **Save**. - **Enter words**: `BULK` > **Add** > **Save**. - **Apply this rule if**: Select **+** to add a second condition. - - **And**: *The sender* > *IP address is in any of these ranges or exactly matches* > enter the egress IPs mentioned in Egress IPs. + - **And**: _The sender_ > _IP address is in any of these ranges or exactly matches_ > enter the egress IPs mentioned in Egress IPs. - **Do the following** - _Modify the message properties_ > _Set the Spam Confidence Level (SCL)_ > _5_. 5. Select **Next**. @@ -90,14 +94,14 @@ To create the transport rules that will send emails with certain [dispositions]( 8. Select the rule **Email Security Deliver to Junk Email folder** you have just created, and **Enable**. 9. Select **Add a Rule** > **Create a new rule**. 10. Set the following rule conditions: - - **Name**: `Email Security Deliver to Junk Email folder`. - - **Apply this rule if**: *The message headers* > *includes any of these words*. + - **Apply this rule if**: _The message headers_ > _includes any of these words_. - **Enter text**: `X-CFEmailSecurity-Disposition` > **Save**. - **Enter words**: `MALICIOUS`, `UCE`, `SPOOF` > **Add** > **Save**. - **Apply this rule if**: Select **+** to add a second condition. - - **And**: *The sender* > *IP address is in any of these ranges or exactly matches* > enter the egress IPs in the Egress IPs. + - **And**: _The sender_ > _IP address is in any of these ranges or exactly matches_ > enter the egress IPs in the Egress IPs. - **Do the following**: _Redirect the message to_ > _hosted quarantine_. + 11. Select **Next**. 12. You can use the default values on this screen. Select **Next**. 13. Review your settings and select **Finish** > **Done**. @@ -105,7 +109,10 @@ To create the transport rules that will send emails with certain [dispositions]( ## 5. Set up MX/Inline - + ## 6. (Recommended) Secure Microsoft 365 from MX records bypass @@ -128,7 +135,6 @@ This step should not be performed until 72 hours after all domains in your Micro 5. Select **Next**. 6. Set the following options: - - **Name** - `Secure M365 Inbound` - **Description** - `Only accept inbound email from Email Security` @@ -146,4 +152,4 @@ This step should not be performed until 72 hours after all domains in your Micro 13. Select **Next**. -14. Review your settings and select **Create connector**. \ No newline at end of file +14. Review your settings and select **Create connector**. diff --git a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/five-junk-admin-quarantine.mdx b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/five-junk-admin-quarantine.mdx index 92d42af3d4cfd8b..973441862a97121 100644 --- a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/five-junk-admin-quarantine.mdx +++ b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/five-junk-admin-quarantine.mdx @@ -6,17 +6,39 @@ sidebar: head: - tag: title content: Deliver emails to the junk email folder - Microsoft 365 - --- -import { Render } from "~/components" +import { Render } from "~/components"; In this tutorial, you will learn to deliver `BULK` messages to the user's junk email folder, and `MALICIOUS`, `SPAM`, and `SPOOF` messages to the Administrative Quarantine (this requires an administrator to release the emails). ## Configure anti-spam policies - + ## Create transport rules - _Set the Spam Confidence Level (SCL)_ > _5_", four: "step4-rules.png", five: "`Email Security Admin Managed Host Quarantine`", six: " `MALICIOUS`, `UCE`, `SPOOF`", seven: "_Redirect the message to_ > _hosted quarantine_", eight: "step10-hosted-quarantine-case5.png" }} /> + _Set the Spam Confidence Level (SCL)_ > _5_", + four: "step4-rules.png", + five: "`Email Security Admin Managed Host Quarantine`", + six: " `MALICIOUS`, `UCE`, `SPOOF`", + seven: "_Redirect the message to_ > _hosted quarantine_", + eight: "step10-hosted-quarantine-case5.png", + }} +/> diff --git a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/four-user-quarantine-admin-quarantine.mdx b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/four-user-quarantine-admin-quarantine.mdx index afbbd86ad620fa5..e3a4e7a8163ac44 100644 --- a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/four-user-quarantine-admin-quarantine.mdx +++ b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/four-user-quarantine-admin-quarantine.mdx @@ -59,6 +59,7 @@ To configure anti-spam policies: + ### Add mTLS to your Access application - + 5. In **Associated hostnames**, enter the fully-qualified domain names (FQDN) that will use this certificate. @@ -41,28 +45,31 @@ The mTLS certificate is used only to verify the client certificate. It does not 6. Save the policy. -9. Go to **Access** > **Policies**. +7. Go to **Access** > **Policies**. + +8. [Create an Access policy](/cloudflare-one/policies/access/policy-management/#create-a-policy) using one of the following [selectors](/cloudflare-one/policies/access/#selectors): + - **Valid Certificate**: Any client certificate that can authenticate with the Root CA will be allowed to proceed. + - **Common Name**: Only client certificates with a specific common name will be allowed to proceed. + +9. If this is for a client who does not need to log in through an IdP, set the policy **Action** to _Service Auth_. + + -10. [Create an Access policy](/cloudflare-one/policies/access/policy-management/#create-a-policy) using one of the following [selectors](/cloudflare-one/policies/access/#selectors): - - **Valid Certificate**: Any client certificate that can authenticate with the Root CA will be allowed to proceed. - - **Common Name**: Only client certificates with a specific common name will be allowed to proceed. + **Example mTLS policy** -11. If this is for a client who does not need to log in through an IdP, set the policy **Action** to _Service Auth_. + | Action | Rule type | Selector | Value | + | ------------ | --------- | ----------- | ---------- | + | Service Auth | Include | Common Name | `John Doe` | - - **Example mTLS policy** - | Action | Rule type | Selector | Value | - | ------ | --------- | -------- | ----------------- | - | Service Auth | Include | Common Name | `John Doe` | - + -12. Save the policy, then go to **Access** > **Applications**. +10. Save the policy, then go to **Access** > **Applications**. -13. Select the application you would like to enforce mTLS on and select **Configure**. The application must be included in the **Associated hostnames** list from Step 5. +11. Select the application you would like to enforce mTLS on and select **Configure**. The application must be included in the **Associated hostnames** list from Step 5. -14. In the **Policies** tab, add your mTLS policy. +12. In the **Policies** tab, add your mTLS policy. -15. Save the application. +13. Save the application. You can now authenticate to the application using a client certificate. For instructions on how to present a client certificate, refer to [Test mTLS](#test-mtls). @@ -106,7 +113,11 @@ The command adds the client certificate to the trusted store on your device. Onl ::: 1. Navigate to the directory containing the client certificate and key. - + Assuming your browser uses the macOS system store, you can now connect to the mTLS application through the browser. @@ -122,64 +133,64 @@ This section covers how to use [OpenSSL](https://www.openssl.org/) to generate a 1. Generate the root CA private key: - ```sh - openssl genrsa -aes256 -out rootCA.key 4096 - ``` + ```sh + openssl genrsa -aes256 -out rootCA.key 4096 + ``` - When prompted, enter a password to use with `rootCA.key`. + When prompted, enter a password to use with `rootCA.key`. 2. Create a self-signed root certificate called `rootCA.pem`: - ```sh - openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem - ``` + ```sh + openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem + ``` - You will be prompted to enter your private key password and fill in some optional fields. For testing purposes, you can leave the optional fields blank. + You will be prompted to enter your private key password and fill in some optional fields. For testing purposes, you can leave the optional fields blank. #### Generate an intermediate certificate 1. Generate the intermediate CA private key: - ```sh - openssl genrsa -aes256 -out intermediate.key 4096 - ``` + ```sh + openssl genrsa -aes256 -out intermediate.key 4096 + ``` - When prompted, enter a password to use with `intermediate.key`. + When prompted, enter a password to use with `intermediate.key`. 2. Create a certificate signing request (CSR) for the intermediate certificate: - ```sh - openssl req -new -sha256 -key intermediate.key -out intermediate.csr - ``` + ```sh + openssl req -new -sha256 -key intermediate.key -out intermediate.csr + ``` - You will be prompted to enter your private key password and fill in some optional fields. For testing purposes, you can leave the optional fields blank. + You will be prompted to enter your private key password and fill in some optional fields. For testing purposes, you can leave the optional fields blank. 3. Create a CA Extension file called `v3_intermediate_ca.ext`. For example, - ```txt - subjectKeyIdentifier = hash - authorityKeyIdentifier = keyid:always,issuer - basicConstraints = critical, CA:true - keyUsage = critical, cRLSign, keyCertSign - ``` + ```txt + subjectKeyIdentifier = hash + authorityKeyIdentifier = keyid:always,issuer + basicConstraints = critical, CA:true + keyUsage = critical, cRLSign, keyCertSign + ``` - Make sure that `basicConstraints` includes the `CA:true` property. This property allows the intermediate certificate to act as a CA and sign client certificates. + Make sure that `basicConstraints` includes the `CA:true` property. This property allows the intermediate certificate to act as a CA and sign client certificates. 4. Sign the intermediate certificate with the root CA: - ```sh - openssl x509 -req -in intermediate.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out intermediate.pem -days 1825 -sha256 -extfile v3_intermediate_ca.ext - ``` + ```sh + openssl x509 -req -in intermediate.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out intermediate.pem -days 1825 -sha256 -extfile v3_intermediate_ca.ext + ``` #### Create a CA chain file 1. Combine the intermediate and root certificates into a single file: - ```sh - cat intermediate.pem rootCA.pem > ca-chain.pem - ``` + ```sh + cat intermediate.pem rootCA.pem > ca-chain.pem + ``` - The intermediate certificate should be at the top of the file, followed by its signing certificate. + The intermediate certificate should be at the top of the file, followed by its signing certificate. 2. Upload the contents of `ca-chain.pem` to Cloudflare Access. For instructions, refer to [Add mTLS to your Access application](#add-mtls-to-your-access-application). @@ -187,33 +198,33 @@ This section covers how to use [OpenSSL](https://www.openssl.org/) to generate a 1. Generate a private key for the client: - ```sh - openssl genrsa -out client.key 2048 - ``` + ```sh + openssl genrsa -out client.key 2048 + ``` 2. Create a CSR for the client certificate: - ```sh - openssl req -new -key client.key -out client.csr - ``` + ```sh + openssl req -new -key client.key -out client.csr + ``` - You will be prompted to fill in some optional fields. For testing purposes, you can set **Common Name** to something like `John Doe`. + You will be prompted to fill in some optional fields. For testing purposes, you can set **Common Name** to something like `John Doe`. 3. Sign the client certificate with the intermediate certificate: - ```sh - openssl x509 -req -in client.csr -CA intermediate.pem -CAkey intermediate.key -CAcreateserial -out client.pem -days 365 -sha256 - ``` + ```sh + openssl x509 -req -in client.csr -CA intermediate.pem -CAkey intermediate.key -CAcreateserial -out client.pem -days 365 -sha256 + ``` 4. Validate the client certificate against the certificate chain: - ```sh - openssl verify -CAfile ca-chain.pem client.pem - ``` + ```sh + openssl verify -CAfile ca-chain.pem client.pem + ``` - ```sh output - client.pem: OK - ``` + ```sh output + client.pem: OK + ``` You can now use the client certificate (`client.pem`) and its key (`client.key`) to [test mTLS](#test-mtls). @@ -236,7 +247,6 @@ Use the instructions under Installation to install the toolkit, and ensure that 1. Create a new directory to store the root CA. 2. Within that directory, create two new files: - - **CSR**. Create a file named `ca-csr.json` and add the following JSON blob, then save the file. ```json diff --git a/src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx b/src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx index 5b934d91cdcd4e0..3cc3ffa7ff8c9c0 100644 --- a/src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx @@ -6,10 +6,9 @@ sidebar: head: - tag: title content: Integrate Tanium with Access - --- -import { Render } from "~/components" +import { Render } from "~/components"; :::note Not recommended for new deployments. We recommend using the [Tanium service-to-service integration](/cloudflare-one/identity/devices/service-providers/taniums2s/) to get device posture signals from Tanium. @@ -19,25 +18,28 @@ Cloudflare Access can use endpoint data from [Tanium™](https://www.tanium.com/ :::caution[Gateway device posture limitation] - The Tanium integration cannot be used with [Gateway device posture policies](/cloudflare-one/policies/gateway/network-policies/#device-posture). - ::: ## Prerequisites -* Tanium Core Platform version 7.2 or later -* +- Tanium Core Platform version 7.2 or later +- ## Integrate Tanium with Cloudflare Access :::note - The integration does not currently support Safari. - ::: 1. Configure your Tanium deployment using the [step-by-step documentation](https://docs.tanium.com/endpoint_identity/endpoint_identity/userguide.html) provided. You will need the public key to integrate your Tanium deployment with Cloudflare Access. diff --git a/src/content/docs/cloudflare-one/identity/devices/service-providers/crowdstrike.mdx b/src/content/docs/cloudflare-one/identity/devices/service-providers/crowdstrike.mdx index cb5f9b9e9d969f4..74bdab7268498d6 100644 --- a/src/content/docs/cloudflare-one/identity/devices/service-providers/crowdstrike.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/service-providers/crowdstrike.mdx @@ -3,20 +3,30 @@ pcx_content_type: how-to title: CrowdStrike sidebar: order: 4 - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + ## Prerequisites Device posture with Crowdstrike requires: -* Falcon Enterprise plan or above -* Crowdstrike agent is deployed on the device. -* +- Falcon Enterprise plan or above +- Crowdstrike agent is deployed on the device. +- ## Set up CrowdStrike as a service provider @@ -24,10 +34,10 @@ Device posture with Crowdstrike requires: The following CrowdStrike values are needed to set up the CrowdStrike posture check: -* Client ID -* Client Secret -* Base URL -* Customer ID +- Client ID +- Client Secret +- Base URL +- Customer ID To retrieve those values: @@ -35,20 +45,25 @@ To retrieve those values: 2. Go to **Support and resources** > **API Clients and Keys**. 3. Select **Create API client** and enter any name for the client. 4. Turn on the following API permissions: - | Scope | Permission | - | ----- | ---------- | - | Detections | Read | - | Hosts | Read | - | Event Streams | Read | - | User Management | Read | - | Zero Trust Assessment | Read | + | Scope | Permission | + | ----- | ---------- | + | Detections | Read | + | Hosts | Read | + | Event Streams | Read | + | User Management | Read | + | Zero Trust Assessment | Read | 5. Select **Create**. 6. Copy the **Client ID**, **Client Secret**, and **Base URL** to a safe place. 7. Go to **Host setup and management** > **Sensor downloads** and copy your **Customer ID**. ### 2. Add CrowdStrike as a service provider - + + 5. Enter the **Client ID** and **Client secret** you noted down above. 6. In **Rest API URL**, enter your **Base URL**. 7. Enter your **Customer ID**. @@ -57,17 +72,21 @@ To retrieve those values: ### 3. Configure the posture check - + ## Device posture attributes Device posture data is gathered from the [CrowdStrike Zero Trust Assessment APIs](https://falcon.us-2.crowdstrike.com/documentation/156/zero-trust-assessment-apis). To learn more about how scores are calculated, refer to the [CrowdStrike Zero Trust Assessment](https://falcon.us-2.crowdstrike.com/documentation/138/zero-trust-assessment) documentation. -| Selector | Description | Value | -| ------------- | ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | -| OS | OS signal score | `1` to `100` | -| Overall | Overall ZTA score | `1` to `100` | -| Sensor config | Sensor signal score | `1` to `100` | -| Version | ZTA score version | `2.1.0` | -| State | Current online status of the device | *Online*, *Offline*, or *Unknown* | +| Selector | Description | Value | +| ------------- | ------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | +| OS | OS signal score | `1` to `100` | +| Overall | Overall ZTA score | `1` to `100` | +| Sensor config | Sensor signal score | `1` to `100` | +| Version | ZTA score version | `2.1.0` | +| State | Current online status of the device | _Online_, _Offline_, or _Unknown_ | | Last seen | Elapsed time since the device was last seen. Only returned if its state is `online` or `unknown`. | In the last 1 hour, 3 hours, 6 hours, 12 hours, 24 hours, 7 days, 30 days, or more than 30 days | diff --git a/src/content/docs/cloudflare-one/identity/devices/service-providers/custom.mdx b/src/content/docs/cloudflare-one/identity/devices/service-providers/custom.mdx index ef770afa885acfd..4b12ca833c42fcf 100644 --- a/src/content/docs/cloudflare-one/identity/devices/service-providers/custom.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/service-providers/custom.mdx @@ -118,8 +118,10 @@ To create a custom service-to-service integration: + 5. In **Access client ID** and **Access client secret**, enter the Access service token used to authenticate to your external API. 6. In **Rest API URL**, enter the external API endpoint that Cloudflare will query for posture information (for example, `https://api.example.com`). For more information, refer to [External API requirements](#external-api-requirements). 7. In **Polling frequency**, choose how often Cloudflare Zero Trust should query the external API for information. @@ -131,6 +133,7 @@ Next, [configure a device posture check](#4-configure-the-posture-check) to dete diff --git a/src/content/docs/cloudflare-one/identity/devices/service-providers/kolide.mdx b/src/content/docs/cloudflare-one/identity/devices/service-providers/kolide.mdx index 63876bae4304ecd..a85c6573f552b76 100644 --- a/src/content/docs/cloudflare-one/identity/devices/service-providers/kolide.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/service-providers/kolide.mdx @@ -3,17 +3,27 @@ pcx_content_type: how-to title: Kolide sidebar: order: 4 - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + ## Prerequisites -* Kolide agent is deployed on the device. -* +- Kolide agent is deployed on the device. +- ## Set up Kolide as a service provider @@ -27,14 +37,23 @@ import { Render } from "~/components" ### 2. Add Kolide as a service provider - + + 5. Enter the **Client secret** you noted down above. 6. Choose a **Polling frequency** for how often Cloudflare Zero Trust should query Kolide for information. 7. Select **Test and save**. ### 3. Configure the posture check - + ## Device posture attributes diff --git a/src/content/docs/cloudflare-one/identity/devices/service-providers/microsoft.mdx b/src/content/docs/cloudflare-one/identity/devices/service-providers/microsoft.mdx index 3b286de0dc9851c..14cf0b98aa72d2c 100644 --- a/src/content/docs/cloudflare-one/identity/devices/service-providers/microsoft.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/service-providers/microsoft.mdx @@ -3,28 +3,38 @@ pcx_content_type: how-to title: Microsoft Endpoint Manager sidebar: order: 4 - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + ## Prerequisites Device posture with Microsoft Endpoint Manager requires: -* An Intune license -* Microsoft Endpoint Manager is managing the device. -* +- An Intune license +- Microsoft Endpoint Manager is managing the device. +- ## 1. Obtain Microsoft Graph settings The following values are required: -* Client secret -* Application (client) ID -* Direct (tenant) ID +- Client secret +- Application (client) ID +- Direct (tenant) ID To retrieve those values: @@ -43,14 +53,23 @@ To retrieve those values: ## 2. Add Intune as a service provider - + + 5. Enter the **Client ID**, **Client secret** and **Customer ID** as you noted down above. 6. Select a **Polling frequency** for how often Cloudflare Zero Trust should query Microsoft Graph API for information. 7. Select **Test and save**. ## 3. Configure the posture check - + ## Device posture attributes diff --git a/src/content/docs/cloudflare-one/identity/devices/service-providers/sentinelone.mdx b/src/content/docs/cloudflare-one/identity/devices/service-providers/sentinelone.mdx index a379cfc40d7a007..ba5b93869e25cec 100644 --- a/src/content/docs/cloudflare-one/identity/devices/service-providers/sentinelone.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/service-providers/sentinelone.mdx @@ -10,13 +10,18 @@ head: import { Render } from "~/components"; - + ## Prerequisites - SentinelOne agent is deployed on the device. - + 5. In **Client Secret**, enter your **API Token**. 6. In **Rest API URL**, enter `https://.sentinelone.net`. 7. Choose a **Polling frequency** for how often Cloudflare Zero Trust should query SentinelOne for information. @@ -56,6 +61,7 @@ To retrieve those values: diff --git a/src/content/docs/cloudflare-one/identity/devices/service-providers/taniums2s.mdx b/src/content/docs/cloudflare-one/identity/devices/service-providers/taniums2s.mdx index 1ec50df6ee501cc..429c58dc2408e06 100644 --- a/src/content/docs/cloudflare-one/identity/devices/service-providers/taniums2s.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/service-providers/taniums2s.mdx @@ -6,18 +6,28 @@ sidebar: head: - tag: title content: Tanium - Posture checks - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + ## Prerequisites -* Either Tanium Cloud or on-premise installations of Tanium with the Benchmark entitlement -* Tanium agent is deployed on the device. -* +- Either Tanium Cloud or on-premise installations of Tanium with the Benchmark entitlement +- Tanium agent is deployed on the device. +- ## Set up Tanium as a service provider @@ -25,8 +35,8 @@ import { Render } from "~/components" The following Tanium values are needed to set up the Tanium posture check: -* Client Secret -* REST API URL +- Client Secret +- REST API URL To retrieve the client secret, create an API token: @@ -40,26 +50,35 @@ To retrieve the client secret, create an API token: To retrieve the API URL, determine your Tanium Gateway root endpoint: -* Tanium Cloud: `https://-api.cloud.tanium.com/plugin/products/gateway/graphql` -* Tanium On Prem: `https:///plugin/products/gateway/graphql` +- Tanium Cloud: `https://-api.cloud.tanium.com/plugin/products/gateway/graphql` +- Tanium On Prem: `https:///plugin/products/gateway/graphql` ### 2. Add Tanium as a service provider - + + 5. Enter the **Client Secret** and **REST API URL** you noted down above. 6. Choose a **Polling frequency** for how often Cloudflare Zero Trust should query Tanium for information. 7. Select **Test and save**. ### 3. Configure the posture check - + ## Device posture attributes Device posture data is gathered from [Tanium's EndpointRisk API](https://developer.tanium.com/site/global/apis/graphql/spectaql/index.gsp#definition-EndpointRisk). To learn more about how scores are calculated, refer to the [Tanium risk score documentation](https://help.tanium.com/bundle/ug_benchmark_cloud/page/benchmark/risk_score.html). -| Selector | Description | Value | -| ----------- | ------ | --- | -| Total score | `totalScore` of the device. | `1` to `1000` | -| Risk level | `riskLevel` of the device. | Low, medium, high, or critical | -| EID last seen | Elapsed time since the device was last seen, based on its `datetime` attribute. | In the last 1 hour, 3 hours, 6 hours, 12 hours, 24 hours, 7 days, 30 days, or more than 30 days | \ No newline at end of file +| Selector | Description | Value | +| ------------- | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | +| Total score | `totalScore` of the device. | `1` to `1000` | +| Risk level | `riskLevel` of the device. | Low, medium, high, or critical | +| EID last seen | Elapsed time since the device was last seen, based on its `datetime` attribute. | In the last 1 hour, 3 hours, 6 hours, 12 hours, 24 hours, 7 days, 30 days, or more than 30 days | diff --git a/src/content/docs/cloudflare-one/identity/devices/service-providers/uptycs.mdx b/src/content/docs/cloudflare-one/identity/devices/service-providers/uptycs.mdx index f344d0a3118459a..a999c0fa328280c 100644 --- a/src/content/docs/cloudflare-one/identity/devices/service-providers/uptycs.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/service-providers/uptycs.mdx @@ -3,25 +3,35 @@ pcx_content_type: how-to title: Uptycs sidebar: order: 4 - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + ## Prerequisites -* Uptycs agent is deployed on the device. -* +- Uptycs agent is deployed on the device. +- ## 1. Obtain Uptycs Settings The following Uptycs values are needed to set up the Uptycs posture check: -* Client key -* Client Secret -* Customer ID +- Client key +- Client Secret +- Customer ID To obtain these values: @@ -31,14 +41,23 @@ To obtain these values: ## 2. Add Uptycs as a service provider - + + 5. Enter the **Client ID**, **Client secret** and **Customer ID** as you noted down above. 6. Select a **Polling frequency** for how often Cloudflare Zero Trust should query Uptycs for information. 7. Select **Test and save**. ## 3. Configure the posture check - + ## Device posture attributes diff --git a/src/content/docs/cloudflare-one/identity/devices/service-providers/workspace-one.mdx b/src/content/docs/cloudflare-one/identity/devices/service-providers/workspace-one.mdx index b27ead8cb99d7eb..51697f5dddd3f73 100644 --- a/src/content/docs/cloudflare-one/identity/devices/service-providers/workspace-one.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/service-providers/workspace-one.mdx @@ -3,26 +3,36 @@ pcx_content_type: how-to title: Workspace ONE sidebar: order: 4 - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + ## Prerequisites -* Workspace ONE agent is deployed on the device. -* +- Workspace ONE agent is deployed on the device. +- ## 1. Obtain Workspace ONE Settings The following Workspace ONE values are needed to set up the Workspace ONE posture check: -* ClientID -* Client Secret -* REST API URL -* Region-Specific token URL +- ClientID +- Client Secret +- REST API URL +- Region-Specific token URL To retrieve those values: @@ -40,7 +50,12 @@ To retrieve those values: ## 2. Add Workspace ONE as a service provider - + + 5. Enter the **Client ID** and **Client secret** you noted down above. 6. Select a **Polling frequency** for how often Cloudflare Zero Trust should query Workspace ONE for information. 7. Enter the **Region-specific token URL** and **REST API URL** you noted down above. @@ -48,7 +63,11 @@ To retrieve those values: ## 3. Configure the posture check - + ## Device posture attributes diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx index c8dcc649444a1dd..c9e662e2a2e8a11 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx @@ -13,6 +13,7 @@ The Application Check device posture attribute checks that a specific applicatio - +- Carbon Black agent is deployed on the device. +- ## Configure the Carbon Black check @@ -24,7 +30,6 @@ Cloudflare Zero Trust can check if [Carbon Black](https://www.carbonblack.com/) 3. Select **Carbon Black**. 4. You will be prompted for the following information: - 1. **Name**: Enter a unique name for this device posture check. 2. **Operating system**: Select your operating system. You will need to configure one posture check per operating system (macOS and Windows currently supported). 3. **Application Path**: Enter the full path to the Carbon Black process to be checked (for example, `c:\program files\CarbonBlack\CarbonBlack.exe`). diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx index db3a3e97cc5a6b1..6fb4db6b5e1b2e9 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx @@ -51,6 +51,7 @@ To generate a sample root CA for testing, refer to [Generate mTLS certificates]( 1.
- - System keychain -
+ + - System keychain + +
- NSSDB (`/etc/pki/nssdb`) - To search a custom location, enter the absolute file path(s) to the certificate and private key (for example @@ -86,7 +88,7 @@ To generate a sample root CA for testing, refer to [Generate mTLS certificates]( 5. **Common name**: (Optional) To check for a Common Name (CN) on the client certificate, enter a string with optional `${serial_number}` and `${hostname}` variables (for example, `${serial_number}_mycompany`). WARP will search for an exact, case-insensitive match. If you do not specify a common name, WARP will ignore the common name field on the certificate. 6. **Check for Extended Key Usage**: (Optional) Check whether the client certificate has one or more attributes set. Supported values are **Client authentication** (`1.3.6.1.5.5.7.3.2`) and/or **Email** (`1.3.6.1.5.5.7.3.4`). 7. **Check for private key**: (Recommended) When enabled, WARP checks that the device has a private key associated with the client certificate. - 8. **Subject Alternative Name**: (Optional) To check for a Subject Alternative Name (SAN) on the client certificate, enter a string with optional `${serial_number}` and `${hostname}` variables (for example, `${serial_number}_mycompany`). WARP will search for an exact, case-insensitive match. You can add multiple SANs to the posture check — a certificate only needs to match one SAN for the check to pass. + 8. **Subject Alternative Name**: (Optional) To check for a Subject Alternative Name (SAN) on the client certificate, enter a string with optional `${serial_number}` and `${hostname}` variables (for example, `${serial_number}_mycompany`). WARP will search for an exact, case-insensitive match. You can add multiple SANs to the posture check — a certificate only needs to match one SAN for the check to pass. 6. Select **Save**. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx index bb8671766f4614e..d05603eee8623a3 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx @@ -3,16 +3,22 @@ pcx_content_type: how-to title: Device serial numbers sidebar: order: 3 - --- -import { Render } from "~/components" +import { Render } from "~/components"; Cloudflare Zero Trust allows you to build Zero Trust rules based on device serial numbers. You can create these rules so that access to applications is granted only to users connecting from company devices. ## Prerequisites -* +- ## Create a list of serial numbers @@ -24,13 +30,13 @@ To create rules based on device serial numbers, you first need to create a [Gate 3. Give your list a descriptive name, as this name will appear when configuring your policies. -4. Set **List Type** to *Serial numbers*. +4. Set **List Type** to _Serial numbers_. 5. Enter the serial numbers of the devices your team manages, or upload your CSV file. 6. Select **Save**. -You can now create an [Access policy](/cloudflare-one/policies/access/) or a Gateway [network policy](/cloudflare-one/policies/gateway/network-policies/common-policies/#enforce-device-posture) that checks if the device presents a serial number on your list. In Access, the serial number check will appear as a *Device Posture - Serial Number List* selector. In Gateway, your serial number list will appear in the **Value** dropdown when you choose the [Passed Device Posture Check](/cloudflare-one/policies/gateway/network-policies/#device-posture) selector. +You can now create an [Access policy](/cloudflare-one/policies/access/) or a Gateway [network policy](/cloudflare-one/policies/gateway/network-policies/common-policies/#enforce-device-posture) that checks if the device presents a serial number on your list. In Access, the serial number check will appear as a _Device Posture - Serial Number List_ selector. In Gateway, your serial number list will appear in the **Value** dropdown when you choose the [Passed Device Posture Check](/cloudflare-one/policies/gateway/network-policies/#device-posture) selector. ## Validate the serial number diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx index 8ec0a6e2a601422..fd6669388a313f9 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx @@ -3,16 +3,22 @@ pcx_content_type: how-to title: Device UUID sidebar: order: 3 - --- -import { Render } from "~/components" +import { Render } from "~/components"; Cloudflare Zero Trust allows you to build Zero Trust rules based on device UUIDs supplied in an MDM file. You can create these rules so that access to applications is granted only to users connecting from company devices. ## Prerequisites -* +- ## 1. Assign UUIDs to devices @@ -32,7 +38,7 @@ To create rules based on device UUIDs, you first need to create a [Gateway List] 3. Give your list a descriptive name, as this name will appear when configuring your policies. -4. Set **List Type** to *Device IDs*. +4. Set **List Type** to _Device IDs_. 5. Enter the UUIDs of the devices your team manages, or upload your CSV file. @@ -52,10 +58,9 @@ Hyphens are automatically stripped from UUIDs. For example, the posture check wi 3. Select **Unique Client ID**. 4. You will be prompted for the following information: - - * **Name**: Enter a unique name for this device posture check. - * **Operating system**: Select the operating system of the device. - * **List**: Select your [list of UUIDs](#2-create-a-list-of-uuids). + - **Name**: Enter a unique name for this device posture check. + - **Operating system**: Select the operating system of the device. + - **List**: Select your [list of UUIDs](#2-create-a-list-of-uuids). 5. Select **Save**. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx index de78d323d761df7..264d257429e0820 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx @@ -16,6 +16,7 @@ The Disk Encryption device posture attribute ensures that disks are encrypted on - **Posture** and verify that the Domain Joined check is returning the expected results. @@ -48,4 +49,4 @@ To check the domain value on your Windows device: (Get-WmiObject Win32_ComputerSystem).Domain ``` -The command will return the Active Directory domain to which your device belongs. \ No newline at end of file +The command will return the Active Directory domain to which your device belongs. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx index 173a1ea0c2d9b0e..7b98f340a132d83 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx @@ -3,16 +3,22 @@ pcx_content_type: how-to title: File check sidebar: order: 7 - --- -import { Render } from "~/components" +import { Render } from "~/components"; The File Check device posture attribute checks for the presence of a file on a device. You can create multiple file checks for each operating system you need to run it on, or if you need to check for multiple files. ## Prerequisites -* +- ## Configure a file check @@ -23,7 +29,6 @@ The File Check device posture attribute checks for the presence of a file on a d 3. Select **File Check**. 4. You will be prompted for the following information: - 1. **Name**: Enter a unique name for this device posture check. 2. **Operating system**: Select your operating system. 3. **File Path**: Enter a file path (for example, `c:\my folder\myfile.exe`). diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx index 7e3a894e996f84d..412a58c10b41178 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx @@ -16,6 +16,7 @@ The Firewall device posture attribute ensures that a firewall is running on a de - +- ## 1. Enable the Gateway check diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx index ce575c1a16d2c41..9b69e34f5638f6a 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx @@ -6,24 +6,28 @@ sidebar: head: - tag: title content: Require WARP - --- -import { Render } from "~/components" +import { Render } from "~/components"; :::note - This device posture attribute will check for all versions of WARP, including the consumer version. - ::: Cloudflare Zero Trust enables you to restrict access to your applications to devices running the Cloudflare WARP client. This allows you to flexibly ensure that a user's traffic is secure and encrypted before allowing access to a resource protected behind Cloudflare Zero Trust. ## Prerequisites -* +- ## 1. Enable the WARP check diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx index 2fbab8e31724952..46e554f8445dff7 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx +++ b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx @@ -6,17 +6,23 @@ sidebar: head: - tag: title content: SentinelOne - WARP client checks - --- -import { Render } from "~/components" +import { Render } from "~/components"; Cloudflare Zero Trust can check if [SentinelOne](https://www.sentinelone.com/) is running on a device to determine if a request should be allowed to reach a protected resource. ## Prerequisites -* SentinelOne agent is deployed on the device. -* +- SentinelOne agent is deployed on the device. +- ## Configure the SentinelOne check @@ -27,7 +33,6 @@ Cloudflare Zero Trust can check if [SentinelOne](https://www.sentinelone.com/) i 3. Select **SentinelOne**. 4. You will be prompted for the following information: - 1. **Name**: Enter a unique name for this device posture check. 2. **Operating system**: Select your operating system. You will need to configure one posture check per operating system. 3. **Application Path**: Enter the full path to the SentinelOne process to be checked (for example, `C:\Program Files\SentinelOne\Sentinel Agent 21.7.4.1043\SentinelAgent.exe`). diff --git a/src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx b/src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx index 3338eb2ae816119..e2f0928d012c310 100644 --- a/src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx +++ b/src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx @@ -178,6 +178,7 @@ The Microsoft Entra ID integration allows you to synchronize IdP groups and auto diff --git a/src/content/docs/cloudflare-one/identity/idp-integration/generic-oidc.mdx b/src/content/docs/cloudflare-one/identity/idp-integration/generic-oidc.mdx index 8c5bf4a3e73eabe..adfb055f88aa1a8 100644 --- a/src/content/docs/cloudflare-one/identity/idp-integration/generic-oidc.mdx +++ b/src/content/docs/cloudflare-one/identity/idp-integration/generic-oidc.mdx @@ -116,7 +116,11 @@ Your identity provider must support SCIM version 2.0. ### 1. Enable SCIM in Zero Trust - + ### 2. Configure SCIM in the IdP diff --git a/src/content/docs/cloudflare-one/identity/idp-integration/generic-saml.mdx b/src/content/docs/cloudflare-one/identity/idp-integration/generic-saml.mdx index 0d8f1d5ae760d99..cdb816e7cc93233 100644 --- a/src/content/docs/cloudflare-one/identity/idp-integration/generic-saml.mdx +++ b/src/content/docs/cloudflare-one/identity/idp-integration/generic-saml.mdx @@ -98,7 +98,11 @@ Your identity provider must support SCIM version 2.0. ### 1. Enable SCIM in Zero Trust - + ### 2. Configure SCIM in the IdP diff --git a/src/content/docs/cloudflare-one/identity/idp-integration/jumpcloud-saml.mdx b/src/content/docs/cloudflare-one/identity/idp-integration/jumpcloud-saml.mdx index 9cd5c7c126e6d9c..71c0c64dba5dbad 100644 --- a/src/content/docs/cloudflare-one/identity/idp-integration/jumpcloud-saml.mdx +++ b/src/content/docs/cloudflare-one/identity/idp-integration/jumpcloud-saml.mdx @@ -28,21 +28,23 @@ The following steps are specific to setting up JumpCloud with Cloudflare Access. 7. Review the application summary and select **Configure Application**. 8. In the **SSO** tab, configure the following settings: - 1. In **IdP Entity ID**, enter your Cloudflare team domain: + 1. In **IdP Entity ID**, enter your Cloudflare team domain: - ```txt - https://.cloudflareaccess.com/ - ``` - You can find your team name in Zero Trust under **Settings** > **Custom Pages**. + ```txt + https://.cloudflareaccess.com/ + ``` - 2. Set both **SP Entity ID** and **ACS URL** to the following callback URL: + You can find your team name in Zero Trust under **Settings** > **Custom Pages**. - ```txt - https://.cloudflareaccess.com/cdn-cgi/access/callback - ``` - 3. (Optional) Configure SAML attributes that you want to send to Cloudflare Access. + 2. Set both **SP Entity ID** and **ACS URL** to the following callback URL: - 4. Scroll up to **JumpCloud Metadata** and select **Export Metadata**. Save this XML file for use in a [later step](#2-add-jumpcloud-to-zero-trust). + ```txt + https://.cloudflareaccess.com/cdn-cgi/access/callback + ``` + + 3. (Optional) Configure SAML attributes that you want to send to Cloudflare Access. + + 4. Scroll up to **JumpCloud Metadata** and select **Export Metadata**. Save this XML file for use in a [later step](#2-add-jumpcloud-to-zero-trust). 9. In the **User Groups** tab, [assign user groups](https://jumpcloud.com/support/get-started-applications-saml-sso#managing-employee-access-to-applications) to this application. @@ -74,7 +76,8 @@ The JumpCloud integration allows you to synchronize user groups and automaticall ### 2. Configure SCIM in JumpCloud @@ -82,7 +85,7 @@ The JumpCloud integration allows you to synchronize user groups and automaticall 1. In the [JumpCloud Admin Portal](https://console.jumpcloud.com/#/home), go to **SSO Applications**. 2. Select the Cloudflare application that was created when you [Set up JumpCloud as a SAML provider](/cloudflare-one/identity/idp-integration/jumpcloud-saml/#set-up-jumpcloud-as-a-saml-provider). 3. Select the **SSO** tab. -3. To provision user groups, select **Include group attribute** and enter `groups`. The group attribute name has to exactly match `groups` or else it will be sent as a SAML attribute. +4. To provision user groups, select **Include group attribute** and enter `groups`. The group attribute name has to exactly match `groups` or else it will be sent as a SAML attribute. 5. Select the **Identity Management** tab. 6. Make sure that **Enable management of User Groups and Group Membership in this application** is turned on. 7. Select **Configure**. @@ -91,21 +94,21 @@ The JumpCloud integration allows you to synchronize user groups and automaticall 10. Select **Activate**. You will receive a confirmation that the Identity Management integration has been successfully verified. 11. Select **Save**. - + ### Provisioning attributes Provisioning attributes define the user and group properties that JumpCloud will synchronize with Cloudflare Access. By default, JumpCloud will send the following attributes during a SCIM update event: -| JumpCloud user attribute| Cloudflare Access attribute | -| ------------------ | ----------------------- | -| `email` | `email` | -| `firstname` | `givenName` | -| `lastname` | `surname` | +| JumpCloud user attribute | Cloudflare Access attribute | +| ------------------------ | --------------------------- | +| `email` | `email` | +| `firstname` | `givenName` | +| `lastname` | `surname` | | JumpCloud group attribute | Cloudflare Access attribute | -| ------------------ | ----------------------- | -| `name` | `groups` | +| ------------------------- | --------------------------- | +| `name` | `groups` | ## Example API configuration diff --git a/src/content/docs/cloudflare-one/identity/idp-integration/okta.mdx b/src/content/docs/cloudflare-one/identity/idp-integration/okta.mdx index e2e07b296783c02..5bc8dd4d9021697 100644 --- a/src/content/docs/cloudflare-one/identity/idp-integration/okta.mdx +++ b/src/content/docs/cloudflare-one/identity/idp-integration/okta.mdx @@ -93,7 +93,11 @@ If you would like to only maintain one Okta app instance, Okta does support SAML ### 1. Enable SCIM in Zero Trust - + ### 2. Configure SCIM in Okta diff --git a/src/content/docs/cloudflare-one/identity/users/session-management.mdx b/src/content/docs/cloudflare-one/identity/users/session-management.mdx index 164aec708f4f462..b810aaa43cdaef3 100644 --- a/src/content/docs/cloudflare-one/identity/users/session-management.mdx +++ b/src/content/docs/cloudflare-one/identity/users/session-management.mdx @@ -71,6 +71,7 @@ Users who match a policy configured with a _Same as application session timeout_ **Firewall policies** > **DNS**", blockBehaviorAction: "turn on", @@ -102,6 +103,7 @@ To turn on the block page or override your global block page setting for an indi **Firewall policies** > **HTTP**", blockBehaviorAction: "go to", diff --git a/src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx index 7f1f0378ff35635..cd8505a5d969031 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx @@ -21,6 +21,7 @@ When creating a DNS policy, you can select as many security risk categories and @@ -286,7 +287,11 @@ Gateway matches DNS queries against the following selectors, or criteria: ### Application - + ### Authoritative Nameserver IP @@ -354,12 +359,17 @@ Use this selector to filter DNS responses by their `TXT` records. ### Host - + ### Indicator Feeds @@ -430,11 +440,11 @@ Use this selector to match a dynamic list of [category IDs](/cloudflare-one/poli ### Source Continent -Use this selector to filter based on the continent where the query arrived to Gateway from. +Use this selector to filter based on the continent where the query arrived to Gateway from. ### Source Country -Use this selector to filter based on the country where the query arrived to Gateway from. +Use this selector to filter based on the country where the query arrived to Gateway from. ### Source IP @@ -450,11 +460,19 @@ Use this selector to filter based on the country where the query arrived to Gate ## Value - + ## Logical operators - + ## Limitations diff --git a/src/content/docs/cloudflare-one/policies/gateway/egress-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/egress-policies/index.mdx index 911aab7827bb79c..c75408404131d4d 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/egress-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/egress-policies/index.mdx @@ -69,6 +69,7 @@ Gateway matches egress traffic against the following selectors, or criteria: @@ -81,6 +82,7 @@ Gateway matches egress traffic against the following selectors, or criteria: @@ -93,6 +95,7 @@ Gateway matches egress traffic against the following selectors, or criteria: @@ -100,6 +103,7 @@ Gateway matches egress traffic against the following selectors, or criteria: @@ -107,6 +111,7 @@ Gateway matches egress traffic against the following selectors, or criteria: @@ -122,6 +127,7 @@ Gateway matches egress traffic against the following selectors, or criteria: @@ -134,6 +140,7 @@ Gateway matches egress traffic against the following selectors, or criteria: @@ -152,16 +159,17 @@ Gateway matches egress traffic against the following selectors, or criteria: ### Source Continent -The continent of the user making the request. +The continent of the user making the request. ### Source Country -The country of the user making the request. +The country of the user making the request. ### Source Internal IP @@ -169,6 +177,7 @@ The country of the user making the request. @@ -184,6 +193,7 @@ The country of the user making the request. @@ -201,6 +211,7 @@ Gateway uses Rust to evaluate regular expressions. The Rust implementation is sl diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx index 44cf247c884a64e..0cfdb0c2de420ff 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx @@ -23,6 +23,7 @@ An HTTP policy consists of an **Action** as well as a logical expression that de @@ -401,7 +402,11 @@ Gateway matches HTTP traffic against the following selectors, or criteria: ### Application - + :::caution[Multiple API selectors required for Terraform] When using Terraform to create a policy with the [Do Not Inspect](#do-not-inspect) action, you must use the `app.hosts_ids` and `app.supports_ids` selectors. For example, to create a Do Not Inspect policy for Google Cloud Platform traffic, create a policy with both `any(app.hosts_ids[*] in {1245})` and `any(app.supports_ids[*] in {1245})`. @@ -411,6 +416,7 @@ When using Terraform to create a policy with the [Do Not Inspect](#do-not-inspec @@ -422,6 +428,7 @@ Only applies to traffic sent through the [WARP client](/cloudflare-one/connectio @@ -433,6 +440,7 @@ Only applies to traffic sent through the [WARP client](/cloudflare-one/connectio @@ -444,6 +452,7 @@ Only applies to traffic sent through the [WARP client](/cloudflare-one/connectio @@ -455,6 +464,7 @@ Only applies to traffic sent through the [WARP client](/cloudflare-one/connectio @@ -557,6 +567,7 @@ Scans HTTP traffic for the presence of social security numbers and other PII. Yo @@ -584,6 +595,7 @@ The HTTP response status code received by the traffic. @@ -599,6 +611,7 @@ The country of the user making the request. @@ -606,6 +619,7 @@ The country of the user making the request. @@ -649,6 +663,7 @@ The query of a webpage's URL. @@ -658,16 +673,22 @@ The query of a webpage's URL. ## Value - + ## Logical operators diff --git a/src/content/docs/cloudflare-one/policies/gateway/identity-selectors.mdx b/src/content/docs/cloudflare-one/policies/gateway/identity-selectors.mdx index 5f4896102b49c6a..66774c226592d49 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/identity-selectors.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/identity-selectors.mdx @@ -42,7 +42,11 @@ Specify a value from the SAML Attribute Assertion. Use this selector to create identity-based Gateway rules based on a user's email. - + ### User Group IDs @@ -50,6 +54,7 @@ Use this selector to create identity-based Gateway rules based on an IdP group I @@ -59,6 +64,7 @@ Use this selector to create identity-based Gateway rules based on an IdP group e @@ -68,6 +74,7 @@ Use this selector to create identity-based Gateway rules based on an IdP group n diff --git a/src/content/docs/cloudflare-one/policies/gateway/initial-setup/dns.mdx b/src/content/docs/cloudflare-one/policies/gateway/initial-setup/dns.mdx index 1e70801f92bdf6c..e5181deb0588587 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/initial-setup/dns.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/initial-setup/dns.mdx @@ -56,6 +56,7 @@ To verify your device is connected to Zero Trust: diff --git a/src/content/docs/cloudflare-one/policies/gateway/initial-setup/http.mdx b/src/content/docs/cloudflare-one/policies/gateway/initial-setup/http.mdx index 74de55f4c86a8b4..6cf0accae566faa 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/initial-setup/http.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/initial-setup/http.mdx @@ -36,6 +36,7 @@ To verify your device is connected to Zero Trust: diff --git a/src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx index 58355d88fcbd137..734011f9573af0e 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx @@ -25,6 +25,7 @@ A network policy consists of an **Action** as well as a logical expression that @@ -260,6 +261,7 @@ Gateway matches network traffic against the following selectors, or criteria. @@ -267,6 +269,7 @@ Gateway matches network traffic against the following selectors, or criteria. @@ -274,6 +277,7 @@ Gateway matches network traffic against the following selectors, or criteria. @@ -281,6 +285,7 @@ Gateway matches network traffic against the following selectors, or criteria. @@ -288,6 +293,7 @@ Gateway matches network traffic against the following selectors, or criteria. @@ -323,6 +329,7 @@ To enable Gateway filtering on TCP and UDP, go to **Settings** > **Network** > * @@ -358,6 +365,7 @@ The country of the user making the request. @@ -365,6 +373,7 @@ The country of the user making the request. @@ -380,6 +389,7 @@ The country of the user making the request. @@ -393,11 +403,16 @@ The _in_ operator allows you to specify IP addresses or networks using CIDR nota ## Value - + ## Logical operators diff --git a/src/content/docs/cloudflare-one/policies/gateway/network-policies/ssh-logging.mdx b/src/content/docs/cloudflare-one/policies/gateway/network-policies/ssh-logging.mdx index 5b20c3d789b15de..81b8c9026960e96 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/network-policies/ssh-logging.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/network-policies/ssh-logging.mdx @@ -99,6 +99,7 @@ ssh-keygen -R ### Host - + ### Location @@ -133,11 +138,11 @@ For more information on creating a DNS policy, refer to [DNS policies](/cloudfla ### Source Continent -Use this selector to filter based on the continent where the query arrived to Gateway from. +Use this selector to filter based on the continent where the query arrived to Gateway from. ### Source Country -Use this selector to filter based on the country where the query arrived to Gateway from. +Use this selector to filter based on the country where the query arrived to Gateway from. ### Source IP @@ -153,8 +158,16 @@ Use this selector to filter based on the country where the query arrived to Gate ## Value - + ## Logical operators - + diff --git a/src/content/docs/ddos-protection/managed-rulesets/network/network-overrides/configure-dashboard.mdx b/src/content/docs/ddos-protection/managed-rulesets/network/network-overrides/configure-dashboard.mdx index 52565170c35022e..84073e48dedf9f7 100644 --- a/src/content/docs/ddos-protection/managed-rulesets/network/network-overrides/configure-dashboard.mdx +++ b/src/content/docs/ddos-protection/managed-rulesets/network/network-overrides/configure-dashboard.mdx @@ -22,6 +22,7 @@ For more information on the available parameters and allowed values, refer to [R L3/4 DDoS > Network-layer DDoS Protection", diff --git a/src/content/docs/dns/internal-dns/get-started.mdx b/src/content/docs/dns/internal-dns/get-started.mdx index bbd41c69c524bf3..335ebc02e536fe7 100644 --- a/src/content/docs/dns/internal-dns/get-started.mdx +++ b/src/content/docs/dns/internal-dns/get-started.mdx @@ -43,6 +43,7 @@ Follow this guide to get started with Internal DNS. + :::note A wildcard record (`*.example.local`) in the matching internal zone will take precedence over an exact match in a reference zone. @@ -37,10 +37,10 @@ A wildcard record (`*.example.local`) in the matching internal zone will take pr Use the [Update DNS settings](/api/resources/dns/subresources/settings/subresources/zone/methods/edit/) endpoint. In `--json`, specify the `internal_dns` object with the parameter `reference_zone_id`. - + A third zone (C) could also point to zone B as a reference, but zone A cannot add another zone as a reference while also having zone B configured as its reference zone. - \ No newline at end of file + diff --git a/src/content/docs/dns/manage-dns-records/reference/vendor-specific-records.mdx b/src/content/docs/dns/manage-dns-records/reference/vendor-specific-records.mdx index a58249f049006b7..5a311bbd2531ba5 100644 --- a/src/content/docs/dns/manage-dns-records/reference/vendor-specific-records.mdx +++ b/src/content/docs/dns/manage-dns-records/reference/vendor-specific-records.mdx @@ -2,10 +2,9 @@ pcx_content_type: configuration source: https://support.cloudflare.com/hc/en-us/articles/360020991331-Adding-vendor-specific-DNS-records-to-Cloudflare title: Vendor-specific DNS records - --- -import { Render, GlossaryTooltip, Example } from "~/components" +import { Render, GlossaryTooltip, Example } from "~/components"; This article requires prior knowledge of DNS record management via the Cloudflare dashboard. To learn more, refer to Cloudflare's article on [managing DNS records](/dns/manage-dns-records/how-to/create-dns-records/). @@ -17,8 +16,8 @@ Google Workspace requires [specific MX records](https://support.google.com/a/ans Once you [add these records to Cloudflare](/dns/manage-dns-records/how-to/create-dns-records/): -* [Test the configuration](https://toolbox.googleapps.com/apps/checkmx/check) -* Do not add other `MX` records other than those provided by Google. +- [Test the configuration](https://toolbox.googleapps.com/apps/checkmx/check) +- Do not add other `MX` records other than those provided by Google. ### Google Workspace service URLs @@ -34,7 +33,7 @@ loops when browsing to your site through Cloudflare, use Cloudflare's [Full encr To add a site verification record in Cloudflare, follow [Google's documentation](https://support.google.com/a/answer/7173990). -*** +--- ## Amazon @@ -94,13 +93,14 @@ If your Cloudflare zone is on a paid plan, also make sure that the **Flatten** o -| Type | Name | Target | -| ------- | ----- | -------------------------------------------- | -| `CNAME` | `@` | `.cloudfront.net` | +| Type | Name | Target | +| ------- | ---- | ----------------------------------- | +| `CNAME` | `@` | `.cloudfront.net` | -| Type | Name | Target | -| ------- | ----- | -------------------------------------------- | +| Type | Name | Target | +| ------- | ------ | ----------------------------------- | | `CNAME` | `blog` | `.cloudfront.net` | + *** @@ -116,7 +116,7 @@ Follow Microsoft's instructions on [configuring Azure DNS settings](https://lear Then, add Azure's required records to [Cloudflare DNS](/dns/manage-dns-records/how-to/create-dns-records/). -*** +--- ## Miscellaneous vendors @@ -124,8 +124,8 @@ Then, add Azure's required records to [Cloudflare DNS](/dns/manage-dns-records/h You can configure Cloudflare to work with ClickFunnels. The process requires updating your Cloudflare DNS settings. -* [Adding a Cloudflare subdomain](https://help.clickfunnels.com/hc/en-us/articles/360005906774-Adding-A-Cloudflare-Subdomain-) -* [Adding a Cloudflare domain](https://help.clickfunnels.com/hc/en-us/articles/360005906094-Cloudflare-CNAME-Record) +- [Adding a Cloudflare subdomain](https://help.clickfunnels.com/hc/en-us/articles/360005906774-Adding-A-Cloudflare-Subdomain-) +- [Adding a Cloudflare domain](https://help.clickfunnels.com/hc/en-us/articles/360005906094-Cloudflare-CNAME-Record) ### Discourse @@ -139,13 +139,13 @@ To use Cloudflare with Forward Email, refer to [Forward Email configuration with For help with Mailchimp, refer to [Use a custom domain with Mailchimp](https://mailchimp.com/help/connect-domain/). - + ### Ning custom domain For help with Ning, refer to [Use a custom domain with Ning](https://www.ning.com/help/use-your-own-domain-e-g-example-com-for-your-ning-network/). - + ### Rackspace CloudFiles @@ -165,7 +165,6 @@ Refer to SendGrid's documentation for how to [make SendGrid compatible with Clou :::note - You may need to refer to Cloudflare's documentation for updated navigation instructions regarding [adding DNS records](/dns/manage-dns-records/how-to/create-dns-records/) and creating [Configuration rules](/rules/configuration-rules/create-dashboard/). ::: @@ -174,7 +173,7 @@ You may need to refer to Cloudflare's documentation for updated navigation instr For help with SmugMug, refer to [Use a custom domain with SmugMug](https://www.smugmughelp.com/en/articles/363-use-a-custom-domain). - + ### Squarespace @@ -184,9 +183,9 @@ Then, set up your Squarespace DNS records: 1. Get your Squarespace DNS information by following [these instructions](https://support.squarespace.com/hc/articles/213469948). 2. In Cloudflare, [add those records](/dns/manage-dns-records/how-to/create-dns-records/): - * All `A` records should be [Proxied](/dns/proxy-status/) - * The `CNAME` record for `www` should also be **Proxied**. - * The `CNAME` record for `verify.squarespace.com` should be **DNS-only**. + - All `A` records should be [Proxied](/dns/proxy-status/) + - The `CNAME` record for `www` should also be **Proxied**. + - The `CNAME` record for `verify.squarespace.com` should be **DNS-only**. 3. If set up properly, your Squarespace DNS Settings page will now indicate that your 'Settings contain problems.' **This is the expected behavior**. ![Screenshot of error warnings in squarespace](~/assets/images/support/hc-import-squarespace_dns_settings-test-2.png) @@ -201,7 +200,7 @@ If you proxy this record, Squarespace will not be able to verify your domain own Refer to Tumblr's documentation to [get DNS record values](https://help.tumblr.com/hc/en-us/articles/231256548-Custom-Domains). Then, [add records to Cloudflare DNS](/dns/manage-dns-records/how-to/create-dns-records/). - + ### Unbounce @@ -228,8 +227,8 @@ This method means your website is using Cloudflare for DNS only, so all your DNS For help configuring WPEngine sites, refer to: -* [Configuring DNS with WPEngine](https://wpengine.com/support/wordpress-best-practice-configuring-dns-for-wp-engine/) -* [Cloudflare best practices](https://wpengine.com/support/cloudflare-best-practices/) +- [Configuring DNS with WPEngine](https://wpengine.com/support/wordpress-best-practice-configuring-dns-for-wp-engine/) +- [Cloudflare best practices](https://wpengine.com/support/cloudflare-best-practices/) ### Zoho diff --git a/src/content/docs/dns/nameservers/custom-nameservers/account-custom-nameservers.mdx b/src/content/docs/dns/nameservers/custom-nameservers/account-custom-nameservers.mdx index 7745b7b09388ae5..fb69ce1447a27fc 100644 --- a/src/content/docs/dns/nameservers/custom-nameservers/account-custom-nameservers.mdx +++ b/src/content/docs/dns/nameservers/custom-nameservers/account-custom-nameservers.mdx @@ -16,6 +16,7 @@ import { Example, Render, Tabs, TabItem } from "~/components"; - + - Choosing a set from `ns_set 1` through `ns_set 5` will influence how Cloudflare assigns nameservers to your new zones if you configure [DNS zone defaults](/dns/nameservers/nameserver-options/#dns-zone-defaults). diff --git a/src/content/docs/dns/nameservers/custom-nameservers/tenant-custom-nameservers.mdx b/src/content/docs/dns/nameservers/custom-nameservers/tenant-custom-nameservers.mdx index 24942dd85ae3a57..d5773481bd422f2 100644 --- a/src/content/docs/dns/nameservers/custom-nameservers/tenant-custom-nameservers.mdx +++ b/src/content/docs/dns/nameservers/custom-nameservers/tenant-custom-nameservers.mdx @@ -17,6 +17,7 @@ import { Example, Render, APIRequest } from "~/components"; - + ## For account owners diff --git a/src/content/docs/dns/troubleshooting/dns-probe-finished-nxdomain.mdx b/src/content/docs/dns/troubleshooting/dns-probe-finished-nxdomain.mdx index 610f5b7d59318c0..196f1db37cf342e 100644 --- a/src/content/docs/dns/troubleshooting/dns-probe-finished-nxdomain.mdx +++ b/src/content/docs/dns/troubleshooting/dns-probe-finished-nxdomain.mdx @@ -6,12 +6,15 @@ sidebar: head: - tag: title content: Fix DNS_PROBE_FINISHED_NXDOMAIN - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + ## Background @@ -21,12 +24,14 @@ Though visitors sometimes encounter this error — or similarly worded messages ## Potential solutions - + :::note - For additional troubleshooting help, refer to our [Community troubleshooting guide](https://community.cloudflare.com/t/community-tip-fixing-the-dns-probe-finished-nxdomain-error/42818). - ::: diff --git a/src/content/docs/dns/troubleshooting/dns-probe-possible.mdx b/src/content/docs/dns/troubleshooting/dns-probe-possible.mdx index 9d699b4e35c2305..291c084832d4aff 100644 --- a/src/content/docs/dns/troubleshooting/dns-probe-possible.mdx +++ b/src/content/docs/dns/troubleshooting/dns-probe-possible.mdx @@ -6,12 +6,15 @@ sidebar: head: - tag: title content: Fix DNS_PROBE_POSSIBLE error - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + ## Background @@ -21,4 +24,8 @@ Though visitors sometimes encounter this error — or similarly worded messages ## Potential solutions - + diff --git a/src/content/docs/durable-objects/concepts/what-are-durable-objects.mdx b/src/content/docs/durable-objects/concepts/what-are-durable-objects.mdx index 70ada5dc26ff7f8..6230639d64e669f 100644 --- a/src/content/docs/durable-objects/concepts/what-are-durable-objects.mdx +++ b/src/content/docs/durable-objects/concepts/what-are-durable-objects.mdx @@ -3,12 +3,11 @@ title: What are Durable Objects? pcx_content_type: concept sidebar: order: 2 - --- import { Render } from "~/components"; - + ## Durable Objects highlights @@ -110,4 +109,4 @@ Finally, the following blog posts may help you learn some of the technical imple Get started now by following the ["Get started" guide](/durable-objects/get-started/) to create your first application using Durable Objects. -[^1]: Storage per Durable Object with SQLite is currently 1 GB. This will be raised to 10 GB for general availability. \ No newline at end of file +[^1]: Storage per Durable Object with SQLite is currently 1 GB. This will be raised to 10 GB for general availability. diff --git a/src/content/docs/durable-objects/index.mdx b/src/content/docs/durable-objects/index.mdx index b49ffe030ca2111..7be9043a1a81c8f 100644 --- a/src/content/docs/durable-objects/index.mdx +++ b/src/content/docs/durable-objects/index.mdx @@ -10,10 +10,21 @@ head: content: Overview --- -import { Render, CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct, LinkButton } from "~/components" +import { + Render, + CardGrid, + Description, + Feature, + LinkTitleCard, + Plan, + RelatedProduct, + LinkButton, +} from "~/components"; -Create AI agents, collaborative applications, real-time interactions like chat, and more without needing to coordinate state, have separate storage, or manage infrastructure. + Create AI agents, collaborative applications, real-time interactions like + chat, and more without needing to coordinate state, have separate storage, or + manage infrastructure. @@ -32,11 +43,11 @@ SQLite-backed Durable Objects are now available on the Workers Free plan with th ### What are Durable Objects? - + For more information, refer to the full [What are Durable Objects?](/durable-objects/concepts/what-are-durable-objects/) page. -*** +--- ## Features @@ -44,31 +55,27 @@ For more information, refer to the full [What are Durable Objects?](/durable-obj Learn how Durable Objects coordinate connections among multiple clients or events. - Learn how Durable Objects provide transactional, strongly consistent, and serializable storage. - Learn how WebSocket Hibernation allows you to manage the connections of multiple clients at scale. - Learn how to use alarms to trigger a Durable Object and perform compute in the future at customizable intervals. - -*** +--- ## Related products @@ -76,51 +83,74 @@ Learn how to use alarms to trigger a Durable Object and perform compute in the f Cloudflare Workers provides a serverless execution environment that allows you to create new applications or augment existing ones without configuring or maintaining infrastructure. - D1 is Cloudflare's SQL-based native serverless database. Create a database by importing data or defining your tables and writing your queries within a Worker or through the API. - Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. - -*** +--- ## More resources - -Browse what other developers are building with Durable Objects. + + Browse what other developers are building with Durable Objects. - -Learn about Durable Objects limits. + + Learn about Durable Objects limits. - -Learn about Durable Objects pricing. + + Learn about Durable Objects pricing. - -Learn more about storage and database options you can build with Workers. + + Learn more about storage and database options you can build with Workers. - -Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. + + Connect with the Workers community on Discord to ask questions, show what you + are building, and discuss the platform with other developers. - -Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Developer Platform. + + Follow @CloudflareDev on Twitter to learn about product announcements, and + what is new in Cloudflare Developer Platform. diff --git a/src/content/docs/durable-objects/platform/limits.mdx b/src/content/docs/durable-objects/platform/limits.mdx index 7ea87cbeb9c41d7..520cb9361f57f79 100644 --- a/src/content/docs/durable-objects/platform/limits.mdx +++ b/src/content/docs/durable-objects/platform/limits.mdx @@ -3,7 +3,6 @@ pcx_content_type: concept title: Limits sidebar: order: 2 - --- import { Render, GlossaryTooltip, Details, WranglerConfig } from "~/components"; @@ -12,22 +11,25 @@ Durable Objects are a special kind of Worker, so [Workers Limits](/workers/platf ## SQLite-backed Durable Objects general limits -| Feature | Limit | -| ---------------------------------------- | ----------------------------------------------------------- | -| Number of Objects | Unlimited (within an account or of a given class) | -| Maximum Durable Object classes | 500 (Workers Paid) / 100 (Free) [^1] | -| Storage per account | Unlimited (Workers Paid) / 5GB (Free) [^2] | -| Storage per class | Unlimited [^3] | -| Storage per Durable Object | 10 GB [^3] | -| Key size | Key and value combined cannot exceed 2 MB | -| Value size | Key and value combined cannot exceed 2 MB | -| WebSocket message size | 1 MiB (only for received messages) | -| CPU per request | 30 seconds (default) / configurable to 5 minutes of [active CPU time](/workers/platform/limits/#cpu-time) [^4] | +| Feature | Limit | +| ------------------------------ | -------------------------------------------------------------------------------------------------------------- | +| Number of Objects | Unlimited (within an account or of a given class) | +| Maximum Durable Object classes | 500 (Workers Paid) / 100 (Free) [^1] | +| Storage per account | Unlimited (Workers Paid) / 5GB (Free) [^2] | +| Storage per class | Unlimited [^3] | +| Storage per Durable Object | 10 GB [^3] | +| Key size | Key and value combined cannot exceed 2 MB | +| Value size | Key and value combined cannot exceed 2 MB | +| WebSocket message size | 1 MiB (only for received messages) | +| CPU per request | 30 seconds (default) / configurable to 5 minutes of [active CPU time](/workers/platform/limits/#cpu-time) [^4] | [^1]: Identical to the Workers [script limit](/workers/platform/limits/). + [^2]: Durable Objects both bills and measures storage based on a gigabyte
(1 GB = 1,000,000,000 bytes) and not a gibibyte (GiB).
+ [^3]: Accounts on the Workers Free plan are limited to 5 GB total Durable Objects storage. -[^4]: Each incoming HTTP request or WebSocket *message* resets the remaining available CPU time to 30 seconds. This allows the Durable Object to consume up to 30 seconds of compute after each incoming network request, with each new network request resetting the timer. If you consume more than 30 seconds of compute between incoming network requests, there is a heightened chance that the individual Durable Object is evicted and reset. CPU time per request invocation [can be increased](/durable-objects/platform/limits/#increasing-durable-object-cpu-limits). + +[^4]: Each incoming HTTP request or WebSocket _message_ resets the remaining available CPU time to 30 seconds. This allows the Durable Object to consume up to 30 seconds of compute after each incoming network request, with each new network request resetting the timer. If you consume more than 30 seconds of compute between incoming network requests, there is a heightened chance that the individual Durable Object is evicted and reset. CPU time per request invocation [can be increased](/durable-objects/platform/limits/#increasing-durable-object-cpu-limits).
1. Identical to the Workers [script limit](/workers/platform/limits/). @@ -36,7 +38,8 @@ Durable Objects are a special kind of Worker, so [Workers Limits](/workers/platf 3. Accounts on the Workers Free plan are limited to 5GB total Durable Objects storage. -4. Each incoming HTTP request or WebSocket *message* resets the remaining available CPU time to 30 seconds. This allows the Durable Object to consume up to 30 seconds of compute after each incoming network request, with each new network request resetting the timer. If you consume more than 30 seconds of compute between incoming network requests, there is a heightened chance that the individual Durable Object is evicted and reset. CPU time per request invocation [can be increased](/durable-objects/platform/limits/#increasing-durable-object-cpu-limits). +4. Each incoming HTTP request or WebSocket _message_ resets the remaining available CPU time to 30 seconds. This allows the Durable Object to consume up to 30 seconds of compute after each incoming network request, with each new network request resetting the timer. If you consume more than 30 seconds of compute between incoming network requests, there is a heightened chance that the individual Durable Object is evicted and reset. CPU time per request invocation [can be increased](/durable-objects/platform/limits/#increasing-durable-object-cpu-limits). +
### SQL storage limits @@ -55,34 +58,37 @@ For Durable Object classes with [SQLite storage](/durable-objects/api/storage-ap ## Key-value backed Durable Objects general limits - + -| Feature | Limit for class with key-value storage backend | -| ---------------------------------------- | ---------------------------------------------------------------- | -| Number of Objects | Unlimited (within an account or of a given class) | -| Maximum Durable Object classes | 500 (Workers Paid) / 100 (Free) [^5] | -| Storage per account | 50 GB (can be raised by contacting Cloudflare) [^6] | -| Storage per class | Unlimited | -| Storage per Durable Object | Unlimited | -| Key size | 2 KiB (2048 bytes) | -| Value size | 128 KiB (131072 bytes) | -| WebSocket message size | 1 MiB (only for received messages) | -| CPU per request | 30s (including WebSocket messages) [^7] | +| Feature | Limit for class with key-value storage backend | +| ------------------------------ | --------------------------------------------------- | +| Number of Objects | Unlimited (within an account or of a given class) | +| Maximum Durable Object classes | 500 (Workers Paid) / 100 (Free) [^5] | +| Storage per account | 50 GB (can be raised by contacting Cloudflare) [^6] | +| Storage per class | Unlimited | +| Storage per Durable Object | Unlimited | +| Key size | 2 KiB (2048 bytes) | +| Value size | 128 KiB (131072 bytes) | +| WebSocket message size | 1 MiB (only for received messages) | +| CPU per request | 30s (including WebSocket messages) [^7] | [^5]: Identical to the Workers [script limit](/workers/platform/limits/). + [^6]: Durable Objects both bills and measures storage based on a gigabyte
(1 GB = 1,000,000,000 bytes) and not a gibibyte (GiB).
-[^7]: Each incoming HTTP request or WebSocket *message* resets the remaining available CPU time to 30 seconds. This allows the Durable Object to consume up to 30 seconds of compute after each incoming network request, with each new network request resetting the timer. If you consume more than 30 seconds of compute between incoming network requests, there is a heightened chance that the individual Durable Object is evicted and reset. CPU time per request invocation [can be increased](/durable-objects/platform/limits/#increasing-durable-object-cpu-limits). + +[^7]: Each incoming HTTP request or WebSocket _message_ resets the remaining available CPU time to 30 seconds. This allows the Durable Object to consume up to 30 seconds of compute after each incoming network request, with each new network request resetting the timer. If you consume more than 30 seconds of compute between incoming network requests, there is a heightened chance that the individual Durable Object is evicted and reset. CPU time per request invocation [can be increased](/durable-objects/platform/limits/#increasing-durable-object-cpu-limits).
5. Identical to the Workers [script limit](/workers/platform/limits/). 6. Durable Objects both bills and measures storage based on a gigabyte
(1 GB = 1,000,000,000 bytes) and not a gibibyte (GiB).
-7. Each incoming HTTP request or WebSocket *message* resets the remaining available CPU time to 30 seconds. This allows the Durable Object to consume up to 30 seconds of compute after each incoming network request, with each new network request resetting the timer. If you consume more than 30 seconds of compute between incoming network requests, there is a heightened chance that the individual Durable Object is evicted and reset. CPU time per request invocation [can be increased](/durable-objects/platform/limits/#increasing-durable-object-cpu-limits). +7. Each incoming HTTP request or WebSocket _message_ resets the remaining available CPU time to 30 seconds. This allows the Durable Object to consume up to 30 seconds of compute after each incoming network request, with each new network request resetting the timer. If you consume more than 30 seconds of compute between incoming network requests, there is a heightened chance that the individual Durable Object is evicted and reset. CPU time per request invocation [can be increased](/durable-objects/platform/limits/#increasing-durable-object-cpu-limits). +
## Frequently Asked Questions - \ No newline at end of file + diff --git a/src/content/docs/durable-objects/platform/pricing.mdx b/src/content/docs/durable-objects/platform/pricing.mdx index a79990be0d1bf81..7a4a00f69fcfb2d 100644 --- a/src/content/docs/durable-objects/platform/pricing.mdx +++ b/src/content/docs/durable-objects/platform/pricing.mdx @@ -5,42 +5,47 @@ sidebar: order: 1 --- -import { Render } from "~/components" +import { Render } from "~/components"; Durable Objects can incur two types of billing: compute and storage. - + On Workers Free plan: + - If you exceed any one of the free tier limits, further operations of that type will fail with an error. - Daily free limits reset at 00:00 UTC. - + ## Compute billing examples These examples exclude the costs for the Workers calling the Durable Objects. When modelling the costs of a Durable Object, note that: -* Inactive objects receiving no requests do not incur any duration charges. -* The [WebSocket Hibernation API](/durable-objects/best-practices/websockets/#websocket-hibernation-api) can dramatically reduce duration-related charges for Durable Objects communicating with clients over the WebSocket protocol, especially if messages are only transmitted occasionally at sparse intervals. +- Inactive objects receiving no requests do not incur any duration charges. +- The [WebSocket Hibernation API](/durable-objects/best-practices/websockets/#websocket-hibernation-api) can dramatically reduce duration-related charges for Durable Objects communicating with clients over the WebSocket protocol, especially if messages are only transmitted occasionally at sparse intervals. ### Example 1 This example represents a simple Durable Object used as a co-ordination service invoked via HTTP. -* A single Durable Object was called by a Worker 1.5 million times -* It is active for 1,000,000 seconds in the month +- A single Durable Object was called by a Worker 1.5 million times +- It is active for 1,000,000 seconds in the month In this scenario, the estimated monthly cost would be calculated as: **Requests**: -* (1.5 million requests - included 1 million requests) x $0.15 / 1,000,000 = $0.075 +- (1.5 million requests - included 1 million requests) x $0.15 / 1,000,000 = $0.075 **Compute Duration**: -* 1,000,000 seconds \* 128 MB / 1 GB = 128,000 GB-s -* (128,000 GB-s - included 400,000 GB-s) x $12.50 / 1,000,000 = $0.00 +- 1,000,000 seconds \* 128 MB / 1 GB = 128,000 GB-s +- (128,000 GB-s - included 400,000 GB-s) x $12.50 / 1,000,000 = $0.00 **Estimated total**: \~$0.075 (requests) + $0.00 (compute duration) + minimum $5/mo usage = $5.08 per month @@ -48,23 +53,23 @@ In this scenario, the estimated monthly cost would be calculated as: This example represents a moderately trafficked Durable Objects based application using WebSockets to broadcast game, chat or real-time user state across connected clients: -* 100 Durable Objects have 50 WebSocket connections established to each of them. -* Clients send approximately one message a minute for eight active hours a day, every day of the month. +- 100 Durable Objects have 50 WebSocket connections established to each of them. +- Clients send approximately one message a minute for eight active hours a day, every day of the month. In this scenario, the estimated monthly cost would be calculated as: **Requests**: -* 50 WebSocket connections \* 100 Durable Objects to establish the WebSockets = 5,000 connections created each day \* 30 days = 150,000 WebSocket connection requests. -* 50 messages per minute \* 100 Durable Objects \* 60 minutes \* 8 hours \* 30 days = 72,000,000 WebSocket message requests. -* 150,000 + (72 million requests / 20 for WebSocket message billing ratio) = 3.75 million billing request. -* (3.75 million requests - included 1 million requests) x $0.15 / 1,000,000 = $0.41. +- 50 WebSocket connections \* 100 Durable Objects to establish the WebSockets = 5,000 connections created each day \* 30 days = 150,000 WebSocket connection requests. +- 50 messages per minute \* 100 Durable Objects \* 60 minutes \* 8 hours \* 30 days = 72,000,000 WebSocket message requests. +- 150,000 + (72 million requests / 20 for WebSocket message billing ratio) = 3.75 million billing request. +- (3.75 million requests - included 1 million requests) x $0.15 / 1,000,000 = $0.41. **Compute Duration**: -* 100 Durable Objects \* 60 seconds \* 60 minutes \* 8 hours \* 30 days = 86,400,000 seconds. -* 86,400,000 seconds \* 128 MB / 1 GB = 11,059,200 GB-s. -* (11,059,200 GB-s - included 400,000 GB-s) x $12.50 / 1,000,000 = $133.24. +- 100 Durable Objects \* 60 seconds \* 60 minutes \* 8 hours \* 30 days = 86,400,000 seconds. +- 86,400,000 seconds \* 128 MB / 1 GB = 11,059,200 GB-s. +- (11,059,200 GB-s - included 400,000 GB-s) x $12.50 / 1,000,000 = $133.24. **Estimated total**: $0.41 (requests) + $133.24 (compute duration) + minimum $5/mo usage = $138.65 per month. @@ -72,23 +77,23 @@ In this scenario, the estimated monthly cost would be calculated as: This example represents a horizontally scaled Durable Objects based application using WebSockets to communicate user-specific state to a single client connected to each Durable Object. -* 100 Durable Objects each have a single WebSocket connection established to each of them. -* Clients sent one message every second of the month so that the Durable Objects were active for the entire month. +- 100 Durable Objects each have a single WebSocket connection established to each of them. +- Clients sent one message every second of the month so that the Durable Objects were active for the entire month. In this scenario, the estimated monthly cost would be calculated as: **Requests**: -* 100 WebSocket connection requests. -* 1 message per second \* 100 connections \* 60 seconds \* 60 minutes \* 24 hours \* 30 days = 259,200,000 WebSocket message requests. -* 100 + (259.2 million requests / 20 for WebSocket billing ratio) = 12,960,100 requests. -* (12.9 million requests - included 1 million requests) x $0.15 / 1,000,000 = $1.79. +- 100 WebSocket connection requests. +- 1 message per second \* 100 connections \* 60 seconds \* 60 minutes \* 24 hours \* 30 days = 259,200,000 WebSocket message requests. +- 100 + (259.2 million requests / 20 for WebSocket billing ratio) = 12,960,100 requests. +- (12.9 million requests - included 1 million requests) x $0.15 / 1,000,000 = $1.79. **Compute Duration**: -* 100 Durable Objects \* 60 seconds \* 60 minutes \* 24 hours \* 30 days = 259,200,000 seconds -* 259,200,000 seconds \* 128 MB / 1 GB = 33,177,600 GB-s -* (33,177,600 GB-s - included 400,000 GB-s) x $12.50 / 1,000,000 = $409.72 +- 100 Durable Objects \* 60 seconds \* 60 minutes \* 24 hours \* 30 days = 259,200,000 seconds +- 259,200,000 seconds \* 128 MB / 1 GB = 33,177,600 GB-s +- (33,177,600 GB-s - included 400,000 GB-s) x $12.50 / 1,000,000 = $409.72 **Estimated total**: $1.79 (requests) + $409.72 (compute duration) + minimum $5/mo usage = $416.51 per month @@ -96,30 +101,33 @@ In this scenario, the estimated monthly cost would be calculated as: This example represents a moderately trafficked Durable Objects based application using WebSocket Hibernation to broadcast game, chat or real-time user state across connected clients: -* 100 Durable Objects each have 100 Hibernatable WebSocket connections established to each of them. -* Clients send one message per minute, and it takes 10ms to process a single message in the `webSocketMessage()` handler. Since each Durable Object handles 100 WebSockets, cumulatively each Durable Object will be actively executing JS for 1 second each minute (100 WebSockets \* 10ms). +- 100 Durable Objects each have 100 Hibernatable WebSocket connections established to each of them. +- Clients send one message per minute, and it takes 10ms to process a single message in the `webSocketMessage()` handler. Since each Durable Object handles 100 WebSockets, cumulatively each Durable Object will be actively executing JS for 1 second each minute (100 WebSockets \* 10ms). In this scenario, the estimated monthly cost would be calculated as: **Requests**: -* 100 WebSocket connections \* 100 Durable Objects to establish the WebSockets = 10,000 initial WebSocket connection requests. -* 100 messages per minute1 \* 100 Durable Objects \* 60 minutes \* 24 hours \* 30 days = 432,000,000 requests. -* 10,000 + (432 million requests / 20 for WebSocket billing ratio) = 21,610,000 million requests. -* (21.6 million requests - included 1 million requests) x $0.15 / 1,000,000 = $3.09. +- 100 WebSocket connections \* 100 Durable Objects to establish the WebSockets = 10,000 initial WebSocket connection requests. +- 100 messages per minute1 \* 100 Durable Objects \* 60 minutes \* 24 hours \* 30 days = 432,000,000 requests. +- 10,000 + (432 million requests / 20 for WebSocket billing ratio) = 21,610,000 million requests. +- (21.6 million requests - included 1 million requests) x $0.15 / 1,000,000 = $3.09. **Compute Duration**: -* 100 Durable Objects \* 1 second2 \* 60 minutes \* 24 hours \* 30 days = 4,320,000 seconds -* 4,320,000 seconds \* 128 MB / 1 GB = 552,960 GB-s -* (552,960 GB-s - included 400,000 GB-s) x $12.50 / 1,000,000 = $1.91 +- 100 Durable Objects \* 1 second2 \* 60 minutes \* 24 hours \* 30 days = 4,320,000 seconds +- 4,320,000 seconds \* 128 MB / 1 GB = 552,960 GB-s +- (552,960 GB-s - included 400,000 GB-s) x $12.50 / 1,000,000 = $1.91 **Estimated total**: $3.09 (requests) + $1.91 (compute duration) + minimum $5/mo usage = $10.00 per month -1 100 messages per minute comes from the fact that 100 clients connect to each DO, and each sends 1 message per minute. +1 100 messages per minute comes from the fact that 100 clients +connect to each DO, and each sends 1 message per minute. -2 The example uses 1 second because each Durable Object is active for 1 second per minute. This can also be thought of as 432 million requests that each take 10 ms to execute (4,320,000 seconds). +2 The example uses 1 second because each Durable Object is active for +1 second per minute. This can also be thought of as 432 million requests that +each take 10 ms to execute (4,320,000 seconds). ## Frequently Asked Questions - \ No newline at end of file + diff --git a/src/content/docs/email-routing/email-workers/send-email-workers.mdx b/src/content/docs/email-routing/email-workers/send-email-workers.mdx index f3110d4369b690b..a6aa7606a1edbce 100644 --- a/src/content/docs/email-routing/email-workers/send-email-workers.mdx +++ b/src/content/docs/email-routing/email-workers/send-email-workers.mdx @@ -9,6 +9,7 @@ import { Render, WranglerConfig } from "~/components"; + ## Edit user diff --git a/src/content/docs/email-security/deployment/inline/setup/office-365-area1-mx/use-cases/five-junk-admin-quarantine.mdx b/src/content/docs/email-security/deployment/inline/setup/office-365-area1-mx/use-cases/five-junk-admin-quarantine.mdx index 7d2198aec9de2c0..7465124f23799c8 100644 --- a/src/content/docs/email-security/deployment/inline/setup/office-365-area1-mx/use-cases/five-junk-admin-quarantine.mdx +++ b/src/content/docs/email-security/deployment/inline/setup/office-365-area1-mx/use-cases/five-junk-admin-quarantine.mdx @@ -7,21 +7,47 @@ sidebar: head: - tag: title content: Deliver emails to the junk email folder - Office 365 - --- -import { Render } from "~/components" +import { Render } from "~/components"; In this tutorial, you will learn to deliver `SUSPICIOUS` and `BULK` messages to the user's junk email folder, and `MALICIOUS`, `SPAM`, and `SPOOF` messages to the Administrative Quarantine (this requires an administrator to release the emails). ## Configure domains - + ## Configure anti-spam policies - + ## Create transport rules - _Set the Spam Confidence Level (SCL)_ > _5_", four: "step4-rules.png", five: "`Area 1 Admin Managed Host Quarantine`", six: " `MALICIOUS`, `UCE`, `SPOOF`", seven: "_Redirect the message to_ > _hosted quarantine_", eight: "step10-hosted-quarantine-case5.png" }} /> + _Set the Spam Confidence Level (SCL)_ > _5_", + four: "step4-rules.png", + five: "`Area 1 Admin Managed Host Quarantine`", + six: " `MALICIOUS`, `UCE`, `SPOOF`", + seven: "_Redirect the message to_ > _hosted quarantine_", + eight: "step10-hosted-quarantine-case5.png", + }} +/> diff --git a/src/content/docs/email-security/deployment/inline/setup/office-365-area1-mx/use-cases/four-user-quarantine-admin-quarantine.mdx b/src/content/docs/email-security/deployment/inline/setup/office-365-area1-mx/use-cases/four-user-quarantine-admin-quarantine.mdx index 3080ad475693d5b..80094e9ae5276dc 100644 --- a/src/content/docs/email-security/deployment/inline/setup/office-365-area1-mx/use-cases/four-user-quarantine-admin-quarantine.mdx +++ b/src/content/docs/email-security/deployment/inline/setup/office-365-area1-mx/use-cases/four-user-quarantine-admin-quarantine.mdx @@ -17,6 +17,7 @@ In this tutorial, you will learn to deliver `SPAM` and `SPOOF` messages to the u @@ -79,6 +80,7 @@ To configure anti-spam policies: @@ -39,6 +40,7 @@ In this tutorial, you will learn how to deliver emails to the Office 365 junk em @@ -38,6 +39,7 @@ In this tutorial, you will learn how to deliver `SUSPICIOUS` and `BULK` messages @@ -38,6 +39,7 @@ In this tutorial, you will learn how to deliver `SUSPICIOUS` and `BULK` messages - + - + @@ -39,6 +47,7 @@ The applicable scope of account permissions is `com.cloudflare.api.account`. @@ -72,6 +83,7 @@ The applicable scope of zone permissions is `com.cloudflare.api.account.zone`. diff --git a/src/content/docs/learning-paths/replace-vpn/configure-device-agent/device-profiles.mdx b/src/content/docs/learning-paths/replace-vpn/configure-device-agent/device-profiles.mdx index bbe61ef3201b835..52224a695093ed8 100644 --- a/src/content/docs/learning-paths/replace-vpn/configure-device-agent/device-profiles.mdx +++ b/src/content/docs/learning-paths/replace-vpn/configure-device-agent/device-profiles.mdx @@ -3,9 +3,15 @@ title: Customize device profiles pcx_content_type: overview sidebar: order: 2 - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + diff --git a/src/content/docs/learning-paths/replace-vpn/connect-devices/install-agent.mdx b/src/content/docs/learning-paths/replace-vpn/connect-devices/install-agent.mdx index 24eb40f245e6525..fc645cc381f04f4 100644 --- a/src/content/docs/learning-paths/replace-vpn/connect-devices/install-agent.mdx +++ b/src/content/docs/learning-paths/replace-vpn/connect-devices/install-agent.mdx @@ -3,9 +3,14 @@ title: Download and install WARP pcx_content_type: overview sidebar: order: 1 - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + diff --git a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies.mdx b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies.mdx index b30752d29b99514..96cfbd43968a963 100644 --- a/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies.mdx +++ b/src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies.mdx @@ -133,6 +133,7 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_restrict_quarantined_users" @@ -364,6 +365,7 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule" diff --git a/src/content/docs/learning-paths/secure-internet-traffic/build-http-policies/recommended-http-policies.mdx b/src/content/docs/learning-paths/secure-internet-traffic/build-http-policies/recommended-http-policies.mdx index 8238bf19f8e5adb..61e2bfe5ac8b100 100644 --- a/src/content/docs/learning-paths/secure-internet-traffic/build-http-policies/recommended-http-policies.mdx +++ b/src/content/docs/learning-paths/secure-internet-traffic/build-http-policies/recommended-http-policies.mdx @@ -212,6 +212,7 @@ resource "cloudflare_zero_trust_gateway_policy" "all_http_security_risks_blockli @@ -224,6 +225,7 @@ resource "cloudflare_zero_trust_gateway_policy" "all_http_security_risks_blockli diff --git a/src/content/docs/learning-paths/secure-internet-traffic/configure-device-agent/device-profiles.mdx b/src/content/docs/learning-paths/secure-internet-traffic/configure-device-agent/device-profiles.mdx index 43cd78d073e0930..4ed3e17d79c5ade 100644 --- a/src/content/docs/learning-paths/secure-internet-traffic/configure-device-agent/device-profiles.mdx +++ b/src/content/docs/learning-paths/secure-internet-traffic/configure-device-agent/device-profiles.mdx @@ -3,9 +3,12 @@ title: Customize device profiles pcx_content_type: overview sidebar: order: 2 - --- -import { Render } from "~/components" +import { Render } from "~/components"; - + diff --git a/src/content/docs/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent.mdx b/src/content/docs/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent.mdx index c95da6d78c43926..79e3b2f663469e5 100644 --- a/src/content/docs/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent.mdx +++ b/src/content/docs/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent.mdx @@ -9,6 +9,7 @@ import { Render } from "~/components"; + diff --git a/src/content/docs/pages/framework-guides/deploy-a-brunch-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-brunch-site.mdx index bcdf8f93b8b9bf5..2c009945b67b03e 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-brunch-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-brunch-site.mdx @@ -34,7 +34,11 @@ brunch new proj -s es6 ## Deploy with Cloudflare Pages - + @@ -44,4 +48,8 @@ After deploying your site, you will receive a unique subdomain for your project Every time you commit new code to your Brunch site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/pages/configuration/preview-deployments/) on new pull requests and be able to preview how changes look to your site before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-docusaurus-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-docusaurus-site.mdx index 512b00b15fbf01b..66530a17817b6f7 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-docusaurus-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-docusaurus-site.mdx @@ -32,12 +32,13 @@ To use `create-cloudflare` to create a new Docusaurus project, run the following ## Deploy with Cloudflare Pages - + ### Deploy via the Cloudflare dashboard @@ -49,4 +50,8 @@ Every time you commit new code to your Docusaurus site and push those changes to For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/pages/get-started/). - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-gatsby-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-gatsby-site.mdx index b1c5cac8f57c54b..656c845e5f4ab47 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-gatsby-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-gatsby-site.mdx @@ -37,7 +37,12 @@ npx gatsby new my-gatsby-site https://github.com/alxshelepenok/gatsby-starter-lu ## Deploy with Cloudflare Pages - + @@ -62,4 +67,8 @@ If you have a dynamic route, such as `/users/[id]`, create your proxy redirect b /users/* /users/:id 200 ``` - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-gridsome-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-gridsome-site.mdx index 9ed11d86b06a28c..2f94732c09e2488 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-gridsome-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-gridsome-site.mdx @@ -38,6 +38,7 @@ To deploy your site to Pages: @@ -53,4 +54,8 @@ For the complete guide to deploying your first site to Cloudflare Pages, refer t After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. Every time you commit new code to your Gridsome project, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/pages/configuration/preview-deployments/) on new pull requests, so you can preview how changes to your site look before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-hexo-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-hexo-site.mdx index eb723daa19b0362..ca482a7880379df 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-hexo-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-hexo-site.mdx @@ -90,4 +90,8 @@ Some Hexo themes or plugins have additional requirements for different Node.js v ![Follow the instructions above to set up an environment variable in the Pages dashboard](~/assets/images/pages/framework-guides/node-version-pages.png) - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-hono-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-hono-site.mdx index 73a837ddfc31c9f..9aecc6972d7c9bc 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-hono-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-hono-site.mdx @@ -52,7 +52,7 @@ You should be able to review your generated web application at `http://localhost ## Deploy with Cloudflare Pages - + ### Deploy via the Cloudflare dashboard diff --git a/src/content/docs/pages/framework-guides/deploy-a-hugo-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-hugo-site.mdx index 6dc7fb1ecc45dc0..b8de0bc70da627c 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-hugo-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-hugo-site.mdx @@ -99,7 +99,11 @@ Inside of `hello-world.md`, add some initial content to create your post. Remove ## Deploy with Cloudflare Pages - + @@ -138,4 +142,8 @@ If you plan to use [preview deployments](/pages/configuration/preview-deployment ::: - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-jekyll-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-jekyll-site.mdx index 893757988d4bf03..ccc2cbadec41c38 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-jekyll-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-jekyll-site.mdx @@ -70,7 +70,11 @@ If you are migrating an existing Jekyll project to Pages, confirm that your `Gem ## Deploy with Cloudflare Pages - + @@ -91,4 +95,8 @@ For the complete guide to deploying your first site to Cloudflare Pages, refer t After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. Every time you commit new code to your Jekyll site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/pages/configuration/preview-deployments/) on new pull requests, so you can preview how changes look to your site before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-nuxt-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-nuxt-site.mdx index b4759817113fdc2..618990bcaed355d 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-nuxt-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-nuxt-site.mdx @@ -79,7 +79,11 @@ git push -u origin main ### Create a Pages project - + @@ -172,7 +176,11 @@ export default defineEventHandler(({ context }) => { - + ## Related resources diff --git a/src/content/docs/pages/framework-guides/deploy-a-pelican-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-pelican-site.mdx index dca46f5cb7caa77..e0d2bc2b4165b24 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-pelican-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-pelican-site.mdx @@ -40,7 +40,11 @@ This is the directory name that you will set in the build command. ## Deploy with Cloudflare Pages - + @@ -52,4 +56,8 @@ After deploying your site, you will receive a unique subdomain for your project Every time you commit new code to your Pelican site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/pages/configuration/preview-deployments/) on new pull requests and be able to preview how changes look to your site before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-preact-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-preact-site.mdx index 0aed854b580ddf2..30bba57e95b4a79 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-preact-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-preact-site.mdx @@ -66,4 +66,8 @@ For the complete guide to deploying your first site to Cloudflare Pages, refer t ::: - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-qwik-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-qwik-site.mdx index 71dfb744946f67b..3424e751556d287 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-qwik-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-qwik-site.mdx @@ -42,11 +42,15 @@ npm start ## Deploy with Cloudflare Pages - + ### Deploy via the Cloudflare dashboard - + @@ -82,4 +86,8 @@ export const useGetServerTime = routeLoader$(({ platform }) => { }); ``` - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-react-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-react-site.mdx index b993865db6914ae..b7c01e9553b7343 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-react-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-react-site.mdx @@ -49,7 +49,7 @@ npm run dev ## Deploy with Cloudflare Pages - + ### Deploy via the Cloudflare dashboard @@ -80,4 +80,8 @@ By default, Cloudflare Pages assumes you are developing a single-page applicatio ::: - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-remix-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-remix-site.mdx index 9eda53cb7603a0d..2c56b5389749e69 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-remix-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-remix-site.mdx @@ -58,11 +58,15 @@ npm run dev ## Deploy with Cloudflare Pages - + ### Deploy via the Cloudflare dashboard - + @@ -184,4 +188,8 @@ export default function Index() { } ``` - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-solid-start-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-solid-start-site.mdx index 95d33b5dc3a234e..5afee57f87c99ea 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-solid-start-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-solid-start-site.mdx @@ -62,7 +62,7 @@ export default defineConfig({ ## Deploy with Cloudflare Pages - + ### Deploy via the Cloudflare dashboard @@ -89,4 +89,8 @@ For the complete guide to deploying your first site to Cloudflare Pages, refer t After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. Every time you commit new code to your Solid repository, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/pages/configuration/preview-deployments/) on new pull requests, to preview how changes look to your site before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-sphinx-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-sphinx-site.mdx index 311fe4d78391296..3b4311f061a7591 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-sphinx-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-sphinx-site.mdx @@ -264,4 +264,8 @@ After deploying your site, you will receive a unique subdomain for your project You will also get access to [preview deployments](/pages/configuration/preview-deployments/) on new pull requests, so you can preview how changes look to your site before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-svelte-kit-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-svelte-kit-site.mdx index 893c56a58e327ad..b121e42dff8f4b2 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-svelte-kit-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-svelte-kit-site.mdx @@ -121,12 +121,13 @@ If you are using any adapter different from the default SvelteKit adapter, remem ## Deploy with Cloudflare Pages - + ### Deploy via the Cloudflare dashboard @@ -171,4 +172,8 @@ export const GET = (({ url }) => { For more information about SvelteKit API Routes, refer to the [SvelteKit documentation](https://kit.svelte.dev/docs/routing#server). ::: - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-vite3-project.mdx b/src/content/docs/pages/framework-guides/deploy-a-vite3-project.mdx index 29d5f800a7293df..72adce7ac3ef66b 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-vite3-project.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-vite3-project.mdx @@ -80,4 +80,8 @@ Cloudflare Pages will automatically rebuild your project and deploy it on every Additionally, you will have access to [preview deployments](/pages/configuration/preview-deployments/), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project with a real URL before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-vitepress-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-vitepress-site.mdx index 4e0a90f7ffb9649..d7c784bda114238 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-vitepress-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-vitepress-site.mdx @@ -57,6 +57,7 @@ This step makes sure that unnecessary files are not going to be included in the @@ -72,4 +73,8 @@ For the complete guide to deploying your first site to Cloudflare Pages, refer t After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. Every time you commit and push new code to your VitePress project, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/pages/configuration/preview-deployments/) on new pull requests, so you can preview how changes to your site look before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-vue-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-vue-site.mdx index 4ac0fc53ae00005..2de1cc9e084f120 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-vue-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-vue-site.mdx @@ -35,11 +35,15 @@ To use `create-cloudflare` to create a new Vue project, run the following comman ## Deploy with Cloudflare Pages - + ### Deploy via the Cloudflare dashboard - +
@@ -58,4 +62,8 @@ For the complete guide to deploying your first site to Cloudflare Pages, refer t After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. Every time you commit new code to your Vue application, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/pages/configuration/preview-deployments/) on new pull requests, so you can preview how changes look to your site before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-zola-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-zola-site.mdx index 8f315099962b43e..b5d917bde1a2e6c 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-zola-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-zola-site.mdx @@ -84,7 +84,11 @@ Upon running `zola init`, you will prompted with three questions: ## Deploy with Cloudflare Pages - + @@ -128,4 +132,8 @@ This command uses: - The `base_url` set in `config.toml` when building from the `main` branch - The preview deployment URL (automatically provided by Cloudflare Pages as `$CF_PAGES_URL`) for all other branches - + diff --git a/src/content/docs/pages/framework-guides/deploy-an-analog-site.mdx b/src/content/docs/pages/framework-guides/deploy-an-analog-site.mdx index 41f3678f220bd7e..59e36995d120773 100644 --- a/src/content/docs/pages/framework-guides/deploy-an-analog-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-an-analog-site.mdx @@ -149,7 +149,11 @@ git push -u origin main ### Create a Pages project - + diff --git a/src/content/docs/pages/framework-guides/deploy-an-angular-site.mdx b/src/content/docs/pages/framework-guides/deploy-an-angular-site.mdx index 461cd386ff6849e..994327f32b43500 100644 --- a/src/content/docs/pages/framework-guides/deploy-an-angular-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-an-angular-site.mdx @@ -54,7 +54,11 @@ git push -u origin main ### Create a Pages project - + @@ -71,4 +75,8 @@ Review your first deploy pipeline in progress. Pages installs all dependencies a Additionally, you will have access to [preview deployments](/pages/configuration/preview-deployments/), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project with a real URL before deploying your changes to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-an-astro-site.mdx b/src/content/docs/pages/framework-guides/deploy-an-astro-site.mdx index e7d572b105e6ac9..61d13c766ab6c50 100644 --- a/src/content/docs/pages/framework-guides/deploy-an-astro-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-an-astro-site.mdx @@ -61,11 +61,15 @@ npm run astro add cloudflare ## Deploy with Cloudflare Pages - + ### Deploy via the Cloudflare dashboard - +
@@ -157,4 +161,8 @@ const value = await myKV.get("key"); To learn more about the Astro Cloudflare runtime, refer to the [Access to the Cloudflare runtime](https://docs.astro.build/en/guides/integrations-guide/cloudflare/#access-to-the-cloudflare-runtime) in the Astro documentation. - + diff --git a/src/content/docs/pages/framework-guides/deploy-an-elderjs-site.mdx b/src/content/docs/pages/framework-guides/deploy-an-elderjs-site.mdx index e918bc319cbe8c3..39d89fce5e33372 100644 --- a/src/content/docs/pages/framework-guides/deploy-an-elderjs-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-an-elderjs-site.mdx @@ -33,6 +33,7 @@ The Elder.js template includes a number of pages and examples showing how to bui @@ -56,4 +57,8 @@ For the complete guide to deploying your first site to Cloudflare Pages, refer t ::: - + diff --git a/src/content/docs/pages/framework-guides/deploy-an-eleventy-site.mdx b/src/content/docs/pages/framework-guides/deploy-an-eleventy-site.mdx index 89e92875b1930d9..1f6936ee382ed18 100644 --- a/src/content/docs/pages/framework-guides/deploy-an-eleventy-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-an-eleventy-site.mdx @@ -46,6 +46,7 @@ git push -u origin main @@ -60,4 +61,8 @@ For the complete guide to deploying your first site to Cloudflare Pages, refer t After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. Every time you commit new code to your Eleventy site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/pages/configuration/preview-deployments/) on new pull requests, so you can preview how changes look to your site before deploying them to production. - + diff --git a/src/content/docs/pages/framework-guides/deploy-an-emberjs-site.mdx b/src/content/docs/pages/framework-guides/deploy-an-emberjs-site.mdx index b7c0e136858287d..c3733d8d0be7b3f 100644 --- a/src/content/docs/pages/framework-guides/deploy-an-emberjs-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-an-emberjs-site.mdx @@ -46,6 +46,7 @@ npm start @@ -57,4 +58,8 @@ Every time you commit new code to your Ember site, Cloudflare Pages will automat For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/pages/get-started/). - + diff --git a/src/content/docs/pages/framework-guides/deploy-an-mkdocs-site.mdx b/src/content/docs/pages/framework-guides/deploy-an-mkdocs-site.mdx index 77972d1647cf5c1..222d137e1c829ff 100644 --- a/src/content/docs/pages/framework-guides/deploy-an-mkdocs-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-an-mkdocs-site.mdx @@ -42,7 +42,11 @@ You have successfully created a GitHub repository and pushed your MkDocs project ## Deploy with Cloudflare Pages - + @@ -54,4 +58,8 @@ Every time you commit new code to your MkDocs site, Cloudflare Pages will automa For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/pages/get-started/). - + diff --git a/src/content/docs/pages/framework-guides/deploy-anything.mdx b/src/content/docs/pages/framework-guides/deploy-anything.mdx index b33f6c3f0c9e026..407d0164163399f 100644 --- a/src/content/docs/pages/framework-guides/deploy-anything.mdx +++ b/src/content/docs/pages/framework-guides/deploy-anything.mdx @@ -48,4 +48,8 @@ If you are getting `404` errors when visiting your `*.pages.dev` domain, make su
- + diff --git a/src/content/docs/pages/framework-guides/nextjs/deploy-a-static-nextjs-site.mdx b/src/content/docs/pages/framework-guides/nextjs/deploy-a-static-nextjs-site.mdx index 64a1a401667ab0c..ce559a6b8e145a8 100644 --- a/src/content/docs/pages/framework-guides/nextjs/deploy-a-static-nextjs-site.mdx +++ b/src/content/docs/pages/framework-guides/nextjs/deploy-a-static-nextjs-site.mdx @@ -56,6 +56,7 @@ git push -u origin main diff --git a/src/content/docs/rules/cloud-connector/index.mdx b/src/content/docs/rules/cloud-connector/index.mdx index c6ae7eab7a20e18..fc4756a7edeb74d 100644 --- a/src/content/docs/rules/cloud-connector/index.mdx +++ b/src/content/docs/rules/cloud-connector/index.mdx @@ -17,6 +17,7 @@ Cloud Connector (beta) allows you to route matching incoming traffic from your w diff --git a/src/content/docs/rules/compression-rules/create-api.mdx b/src/content/docs/rules/compression-rules/create-api.mdx index 700d97321bf9130..7c5f56524928bdf 100644 --- a/src/content/docs/rules/compression-rules/create-api.mdx +++ b/src/content/docs/rules/compression-rules/create-api.mdx @@ -22,6 +22,7 @@ When creating a compression rule via API, make sure you: - +
diff --git a/src/content/docs/rules/compression-rules/examples/disable-compression-avif.mdx b/src/content/docs/rules/compression-rules/examples/disable-compression-avif.mdx index 45797c2ecbf4e66..908bc0c408d8c7b 100644 --- a/src/content/docs/rules/compression-rules/examples/disable-compression-avif.mdx +++ b/src/content/docs/rules/compression-rules/examples/disable-compression-avif.mdx @@ -22,7 +22,6 @@ The following example rule will disable compression for AVIF images, based on ei **When incoming requests match** - Custom filter expression: - - _Media Type_ _equals_ `image/avif` **OR** - _File extension_ _equals_ `avif` @@ -54,6 +53,10 @@ The following example sets the rules of an existing [entry point ruleset](/rules }} /> - +
diff --git a/src/content/docs/rules/compression-rules/examples/enable-zstandard.mdx b/src/content/docs/rules/compression-rules/examples/enable-zstandard.mdx index 0457631a76e6037..ba03e68ddeb79e2 100644 --- a/src/content/docs/rules/compression-rules/examples/enable-zstandard.mdx +++ b/src/content/docs/rules/compression-rules/examples/enable-zstandard.mdx @@ -18,7 +18,6 @@ The following example rule will turn on Zstandard compression for response conte **When incoming requests match** - Custom filter expression: - - _Media Type_ _is in_ `text/html, text/richtext, text/plain, text/css, text/x-script, text/x-component, text/x-java-source, text/x-markdown, application/javascript, application/x-javascript, text/javascript, text/js, image/x-icon, image/vnd.microsoft.icon, application/x-perl, application/x-httpd-cgi, text/xml, application/xml, application/rss+xml, application/vnd.api+json, application/x-protobuf, application/json, multipart/bag, multipart/mixed, application/xhtml+xml, font/ttf, font/otf, font/x-woff, image/svg+xml, application/vnd.ms-fontobject, application/ttf, application/x-ttf, application/otf, application/x-otf, application/truetype, application/opentype, application/x-opentype, application/font-woff, application/eot, application/font, application/font-sfnt, application/wasm, application/javascript-binast, application/manifest+json, application/ld+json, application/graphql+json, application/geo+json` **Then** @@ -50,6 +49,10 @@ The following example sets the rules of an existing [entry point ruleset](/rules }} /> - +
diff --git a/src/content/docs/rules/compression-rules/examples/gzip-for-csv.mdx b/src/content/docs/rules/compression-rules/examples/gzip-for-csv.mdx index c61264943f34774..951999d14727273 100644 --- a/src/content/docs/rules/compression-rules/examples/gzip-for-csv.mdx +++ b/src/content/docs/rules/compression-rules/examples/gzip-for-csv.mdx @@ -20,7 +20,6 @@ The following example rule will configure Gzip compression as the preferred comp **When incoming requests match** - Custom filter expression: - - _File extension_ _equals_ `csv` **Then** @@ -51,6 +50,10 @@ The following example sets the rules of an existing [entry point ruleset](/rules }} /> - + diff --git a/src/content/docs/rules/compression-rules/examples/only-brotli-url-path.mdx b/src/content/docs/rules/compression-rules/examples/only-brotli-url-path.mdx index 48f0169fac3a3d2..dcaf12bef48ac7a 100644 --- a/src/content/docs/rules/compression-rules/examples/only-brotli-url-path.mdx +++ b/src/content/docs/rules/compression-rules/examples/only-brotli-url-path.mdx @@ -20,7 +20,6 @@ The following example rule will configure only Brotli compression for a specific **When incoming requests match** - Custom filter expression: - - _URI Path_ _equals_ `/download/assets.tar` **Then** @@ -53,6 +52,10 @@ The following example sets the rules of an existing [entry point ruleset](/rules }} /> - + diff --git a/src/content/docs/rules/compression-rules/index.mdx b/src/content/docs/rules/compression-rules/index.mdx index 057e3f7be7d2d8c..e107d9e10ea8d84 100644 --- a/src/content/docs/rules/compression-rules/index.mdx +++ b/src/content/docs/rules/compression-rules/index.mdx @@ -15,6 +15,7 @@ When there is a match for a compression rule configured with several compression @@ -55,5 +56,6 @@ The following fields are commonly used in expressions of compression rules: diff --git a/src/content/docs/rules/configuration-rules/create-api.mdx b/src/content/docs/rules/configuration-rules/create-api.mdx index bb7431f27aa07c4..779d317d5d41281 100644 --- a/src/content/docs/rules/configuration-rules/create-api.mdx +++ b/src/content/docs/rules/configuration-rules/create-api.mdx @@ -23,6 +23,7 @@ When creating a configuration rule via API, make sure you: - + @@ -83,7 +88,11 @@ The following example sets the rules of an existing phase ruleset (`{ruleset_id} }} /> - + diff --git a/src/content/docs/rules/configuration-rules/examples/define-single-configuration-terraform.mdx b/src/content/docs/rules/configuration-rules/examples/define-single-configuration-terraform.mdx index 72165d00c7605d5..695530b37820372 100644 --- a/src/content/docs/rules/configuration-rules/examples/define-single-configuration-terraform.mdx +++ b/src/content/docs/rules/configuration-rules/examples/define-single-configuration-terraform.mdx @@ -37,6 +37,10 @@ resource "cloudflare_ruleset" "http_config_rules_example" { } ``` - + diff --git a/src/content/docs/rules/configuration-rules/index.mdx b/src/content/docs/rules/configuration-rules/index.mdx index c6e85f21f4f01ae..6113340b39d1453 100644 --- a/src/content/docs/rules/configuration-rules/index.mdx +++ b/src/content/docs/rules/configuration-rules/index.mdx @@ -16,6 +16,7 @@ The configuration rule expression will determine to which requests the rule sett @@ -37,5 +38,6 @@ The number of available configuration rules varies according to your Cloudflare diff --git a/src/content/docs/rules/custom-errors/create-rules.mdx b/src/content/docs/rules/custom-errors/create-rules.mdx index c4a115ddb9aea04..8e9c8891333e370 100644 --- a/src/content/docs/rules/custom-errors/create-rules.mdx +++ b/src/content/docs/rules/custom-errors/create-rules.mdx @@ -16,7 +16,6 @@ import { APIRequest, Render } from "~/components"; 3. Select **Create rule** > **Custom Error Rule**. 4. Enter a descriptive name for the rule in **Rule name**. 5. Under **If incoming requests match**, select one of the following options: - - **Custom filter expression**: The rule will only apply to traffic matching a custom expression. Define the [rule expression](/ruleset-engine/rules-language/expressions/edit-expressions/) to configure which requests should be rewritten. Use either the Expression Builder or the Expression Editor to define the custom expression. For more information, refer to [Edit expressions in the dashboard](/ruleset-engine/rules-language/expressions/edit-expressions/). - **All incoming requests**: The rule will apply to all responses with a `400` status code or above, except for block and challenge actions issued by Cloudflare’s security products. @@ -124,7 +123,11 @@ This example configures a custom error rule returning a [previously created cust }} /> - + This `PUT` request, corresponding to the [Update a zone entry point ruleset](/api/resources/rulesets/subresources/phases/methods/update/) operation, replaces any existing rules in the `http_custom_errors` phase entry point ruleset. diff --git a/src/content/docs/rules/custom-errors/example-rules.mdx b/src/content/docs/rules/custom-errors/example-rules.mdx index 4c1318315b645f4..14040e6d7aca11a 100644 --- a/src/content/docs/rules/custom-errors/example-rules.mdx +++ b/src/content/docs/rules/custom-errors/example-rules.mdx @@ -62,7 +62,11 @@ This example configures a custom JSON error response for all 5XX errors (`500`-` }} /> - + This `PUT` request, corresponding to the [Update a zone entry point ruleset](/api/resources/rulesets/subresources/phases/methods/update/) operation, replaces any existing rules in the `http_custom_errors` phase entry point ruleset. @@ -121,7 +125,11 @@ This example configures a custom HTML error response for responses with a `500` }} /> - + This `PUT` request, corresponding to the [Update a zone entry point ruleset](/api/resources/rulesets/subresources/phases/methods/update/) operation, replaces any existing rules in the `http_custom_errors` phase entry point ruleset. @@ -174,7 +182,11 @@ This example configures a custom HTML error response for [Cloudflare error 1020] }} /> - + This `PUT` request, corresponding to the [Update a zone entry point ruleset](/api/resources/rulesets/subresources/phases/methods/update/) operation, replaces any existing rules in the `http_custom_errors` phase entry point ruleset. @@ -226,7 +238,11 @@ This example configures a custom error rule returning a previously created custo }} /> - + This `PUT` request, corresponding to the [Update a zone entry point ruleset](/api/resources/rulesets/subresources/phases/methods/update/) operation, replaces any existing rules in the `http_custom_errors` phase entry point ruleset. diff --git a/src/content/docs/rules/normalization/index.mdx b/src/content/docs/rules/normalization/index.mdx index 0568db700fd6dd4..d724bad09e8f586 100644 --- a/src/content/docs/rules/normalization/index.mdx +++ b/src/content/docs/rules/normalization/index.mdx @@ -19,6 +19,7 @@ URL normalization does not perform any redirect diff --git a/src/content/docs/rules/origin-rules/create-api.mdx b/src/content/docs/rules/origin-rules/create-api.mdx index 780de4ec2939c55..de872d3897247c2 100644 --- a/src/content/docs/rules/origin-rules/create-api.mdx +++ b/src/content/docs/rules/origin-rules/create-api.mdx @@ -22,6 +22,7 @@ When creating an origin rule via API, make sure you: @@ -65,7 +66,11 @@ The following example sets the rules of an existing phase ruleset (`$RULESET_ID` }} /> - + diff --git a/src/content/docs/rules/origin-rules/examples/define-single-origin-terraform.mdx b/src/content/docs/rules/origin-rules/examples/define-single-origin-terraform.mdx index d466a76cc6eb5f9..3b9d01e05a21e2f 100644 --- a/src/content/docs/rules/origin-rules/examples/define-single-origin-terraform.mdx +++ b/src/content/docs/rules/origin-rules/examples/define-single-origin-terraform.mdx @@ -40,6 +40,10 @@ resource "cloudflare_ruleset" "http_origin_example" { } ``` - + diff --git a/src/content/docs/rules/origin-rules/index.mdx b/src/content/docs/rules/origin-rules/index.mdx index 1ee709480690320..6199a90455e87dc 100644 --- a/src/content/docs/rules/origin-rules/index.mdx +++ b/src/content/docs/rules/origin-rules/index.mdx @@ -21,12 +21,14 @@ The origin rule expression will determine when these overrides will be applied.
@@ -52,5 +54,6 @@ Like [Page Rules](/rules/page-rules/), an origin rule performing a `Host` header diff --git a/src/content/docs/rules/reference/page-rules-migration.mdx b/src/content/docs/rules/reference/page-rules-migration.mdx index 81bff06f0afb74c..8c9e2ff586a7f6f 100644 --- a/src/content/docs/rules/reference/page-rules-migration.mdx +++ b/src/content/docs/rules/reference/page-rules-migration.mdx @@ -127,16 +127,12 @@ You configured a Page Rule to perform an automatic redirect from HTTP to HTTPS f 1. [Create a single redirect](/rules/url-forwarding/single-redirects/create-dashboard/) to always redirect HTTP requests to HTTPS. You can select the **Redirect from HTTP to HTTPS** rule template or enter the following rule configuration: -
- - **If incoming requests match**: Wildcard pattern - - **Request URL**: `http://*` - - - **Then**: - - **Target URL**: `https://${1}` - - **Status code**: _301_ - - **Preserve query string**: Enabled - -
+- **If incoming requests match**: Wildcard pattern + - **Request URL**: `http://*` +- **Then**: + - **Target URL**: `https://${1}` + - **Status code**: _301_ + - **Preserve query string**: Enabled 2. Turn off your existing Page Rule and validate the behavior of the redirect you created. @@ -166,18 +162,18 @@ You configured a Page Rule turning on Automatic HTTPS Rewrites for all subdomain 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to always rewrite HTTP links to HTTPS for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` +
- - **Then the settings are**: - - **Setting**: Automatic HTTPS Rewrites - - **Value**: On +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Automatic HTTPS Rewrites + - **Value**: On -
+
2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -207,21 +203,21 @@ You configured a Page Rule adjusting browser cache TTL to one day for all subdom 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to adjust browser cache TTL for caching resources in the browser to one day for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` +
- - **Then**: - - **Cache eligibility**: Eligible for cache - - **Browser TTL**: Override origin and use this TTL - - **Input time-to-live (TTL)**: _1 day_ +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache + - **Browser TTL**: Override origin and use this TTL + - **Input time-to-live (TTL)**: _1 day_ -
+
- + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -251,18 +247,14 @@ You configured a Page Rule turning on Browser Integrity Check for all subdomains 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to turn on Browser Integrity Check for protecting against bots and threats for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: Browser Integrity Check - - **Value**: On - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Browser Integrity Check + - **Value**: On 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -292,19 +284,15 @@ You configured a Page Rule turning on Bypass Cache on Cookie for all subdomains 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to bypass cache for requests containing cookie `test_cookie` for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com" AND Cookie contains "test-cookie"` - - Using the Expression Editor:
- `(http.host contains "example.com" and http.cookie contains "test-cookie")` +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com" AND Cookie contains "test-cookie"` + - Using the Expression Editor:
+ `(http.host contains "example.com" and http.cookie contains "test-cookie")` +- **Then**: + - **Cache eligibility**: Bypass cache - - **Then**: - - **Cache eligibility**: Bypass cache - -
- - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -334,21 +322,17 @@ You configured a Page Rule turning on Cache By Device Type for all subdomains of 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to cache content based on user agent or device type for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Cache eligibility**: Eligible for cache - - **Setting**: Cache key - - **Cache by device type**: On - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache + - **Setting**: Cache key + - **Cache by device type**: On - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -377,21 +361,17 @@ You configured a Page Rule turning on Cache Deception Armor for all subdomains o 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to protect against cache deception attacks for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache + - **Setting**: Cache key + - **Cache deception armor**: On - - **Then**: - - **Cache eligibility**: Eligible for cache - - **Setting**: Cache key - - **Cache deception armor**: On - -
- - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -421,19 +401,15 @@ You configured a Page Rule turning on caching of all assets for all subdomains o 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to adjust cache level for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Cache eligibility**: Eligible for cache - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -463,19 +439,15 @@ You configured a Page Rule turning on caching for responses that contained cooki 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to cache responses containing cookie `test_cookie` for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com" AND Cookie contains "test-cookie"` - - Using the Expression Editor:
- `(http.host contains "example.com" and http.cookie contains "test-cookie")` +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com" AND Cookie contains "test-cookie"` + - Using the Expression Editor:
+ `(http.host contains "example.com" and http.cookie contains "test-cookie")` +- **Then**: + - **Cache eligibility**: Eligible for cache - - **Then**: - - **Cache eligibility**: Eligible for cache - -
- - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -506,26 +478,22 @@ You configured a Page Rule turning on caching of every response with status code 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to cache responses with status code between `200` and `599` for one day for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Cache eligibility**: Eligible for cache - - **Setting**: Edge TTL - - Use cache-control header if present, use default Cloudflare caching behavior if not - - **Status code TTL**: - - **Scope**: _Range_ - - **From**: _200_ - - **To**: _599_ - - **Duration**: _1 day_ - -
- - +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` + - **Then**: + - **Cache eligibility**: Eligible for cache + - **Setting**: Edge TTL + - Use cache-control header if present, use default Cloudflare caching behavior if not + - **Status code TTL**: + - **Scope**: _Range_ + - **From**: _200_ + - **To**: _599_ + - **Duration**: _1 day_ + + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -555,21 +523,17 @@ You configured a Page Rule setting a custom cache key for all query string param 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to set a custom cache key for all query string parameters, for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Cache eligibility**: Eligible for cache - - **Setting**: Cache key - - **Query string**: All query string parameters - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache + - **Setting**: Cache key + - **Query string**: All query string parameters - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -598,17 +562,13 @@ You configured a Page Rule turning off Cloudflare Apps (deprecated) for all subd 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to disable Cloudflare Apps (deprecated) for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: Disable Apps - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Disable Apps 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -643,19 +603,15 @@ You configured a Page Rule with **Disable Performance** (deprecated) for all sub 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to disable Mirage, Polish, and Rocket Loader for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Mirage**: Off - - **Polish**: _Off_ - - **Rocket Loader**: Off - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Mirage**: Off + - **Polish**: _Off_ + - **Rocket Loader**: Off 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -721,17 +677,13 @@ You configured a Page Rule turning off [Zaraz](/zaraz/) for all subdomains of `e 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to turn off Zaraz for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: Disable Zaraz - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Disable Zaraz 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -761,22 +713,18 @@ You configured a Page Rule adjusting Edge Cache TTL for all subdomains of `examp 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to adjust edge cache TTL for caching resources on Cloudflare edge to one day, for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Cache eligibility**: Eligible for cache - - **Setting**: Edge TTL - - Ignore cache-control header and use this TTL - - **Input time-to-live (TTL)**: _1 day_ +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache + - **Setting**: Edge TTL + - Ignore cache-control header and use this TTL + - **Input time-to-live (TTL)**: _1 day_ -
- - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -806,18 +754,14 @@ You configured a Page Rule turning off [Email Obfuscation](/waf/tools/scrape-shi 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to turn off Email Obfuscation for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: Email Obfuscation - - **Value**: Off - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Email Obfuscation + - **Value**: Off 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -850,16 +794,12 @@ You configured a Page Rule permanently redirecting `www.example.com` to `example 1. [Create a single redirect](/rules/url-forwarding/single-redirects/create-dashboard/) to permanently redirect requests from `https://www.example.com` to `https://example.com`. You can select the **Redirect from WWW to Root** rule template or enter the following rule configuration: -
- - **If incoming requests match**: Wildcard pattern - - **Request URL**: `https://www.example.com/*` - - - **Then**: - - **Target URL**: `https://example.com/${1}` - - **Status code**: _301_ - - **Preserve query string**: Enabled - -
+- **If incoming requests match**: Wildcard pattern + - **Request URL**: `https://www.example.com/*` +- **Then**: + - **Target URL**: `https://example.com/${1}` + - **Status code**: _301_ + - **Preserve query string**: Enabled 2. Turn off your existing Page Rule and validate the behavior of the redirect you created. @@ -867,6 +807,7 @@ You configured a Page Rule permanently redirecting `www.example.com` to `example - - **If incoming requests match**: Wildcard pattern - - **Request URL**: `https://example.com/old-path/*` - - - **Then**: - - **Target URL**: `https://example.com/new-path/${1}` - - **Status code**: _301_ - - **Preserve query string**: Enabled - - +- **If incoming requests match**: Wildcard pattern + - **Request URL**: `https://example.com/old-path/*` +- **Then**: + - **Target URL**: `https://example.com/new-path/${1}` + - **Status code**: _301_ + - **Preserve query string**: Enabled 2. Turn off your existing Page Rule and validate the behavior of the redirect you created. @@ -915,6 +852,7 @@ You configured a Page Rule permanently redirecting `example.com/old-path` to `ex - - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Set origin parameters**: - - **Host Header** > **Rewrite to**: `example.saas-provider.com` - - +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Set origin parameters**: + - **Host Header** > **Rewrite to**: `example.saas-provider.com` 2. Turn off your existing Page Rule and validate the behavior of the origin rule you created. @@ -1012,18 +946,14 @@ You configured a Page Rule turning off Mirage for all subdomains of `example.com 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to turn off Mirage for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: Mirage - - **Value**: Off - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Mirage + - **Value**: Off 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -1053,18 +983,14 @@ You configured a Page Rule turning off Opportunistic Encryption for all subdomai 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to turn off Opportunistic Encryption for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: Opportunistic Encryption - - **Value**: Off - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Opportunistic Encryption + - **Value**: Off 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -1094,21 +1020,17 @@ You configured a Page Rule turning off Origin Cache Control for all subdomains o 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to determine edge cache behavior for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Cache eligibility**: Eligible for cache - - **Setting**: Origin Cache Control - - **Enable Origin Cache Control**: Off +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache + - **Setting**: Origin Cache Control + - **Enable Origin Cache Control**: Off -
- - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -1138,21 +1060,17 @@ You configured a Page Rule turning on Origin Error Page Pass-thru for all subdom 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to determine edge cache behavior for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Cache eligibility**: Eligible for cache - - **Setting**: Origin error page pass-thru - - **Use Origin error page pass-thru**: On - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache + - **Setting**: Origin error page pass-thru + - **Use Origin error page pass-thru**: On - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -1182,18 +1100,14 @@ You configured a Page Rule turning off [Polish](/images/polish/) for all subdoma 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to turn off Polish for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: Polish - - **Select value**: _Off_ - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Polish + - **Select value**: _Off_ 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -1223,21 +1137,17 @@ You configured a Page Rule turning on Query String Sort for all subdomains of `e 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to sort query string parameters for caching purposes, for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Cache eligibility**: Eligible for cache - - **Setting**: Cache key - - **Sort query string**: On - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache + - **Setting**: Cache key + - **Sort query string**: On - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -1267,17 +1177,13 @@ You configured a Page Rule changing the origin to `example.saas-provider.com`, f 1. [Create an origin rule](/rules/origin-rules/create-dashboard/) overriding the origin to `example.saas-provider.com` for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **DNS Record** > **Override to**: `example.saas-provider.com` - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **DNS Record** > **Override to**: `example.saas-provider.com` 2. Turn off your existing Page Rule and validate the behavior of the origin rule you created. @@ -1307,21 +1213,17 @@ You configured a Page Rule turning on byte-for-byte equivalency checks for all s 1. [Create a cache rule](/cache/how-to/cache-rules/create-dashboard/) to respect strong ETags for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then**: - - **Cache eligibility**: Eligible for cache - - **Setting**: Respect strong ETags - - **Use strong ETag headers**: On +- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then**: + - **Cache eligibility**: Eligible for cache + - **Setting**: Respect strong ETags + - **Use strong ETag headers**: On -
- - + 2. Turn off your existing Page Rule and validate the behavior of the cache rule you created. @@ -1351,18 +1253,14 @@ You configured a Page Rule turning off Rocket Loader for all subdomains of `exam 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to turn off Rocket Loader for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: Rocket Loader - - **Value**: Off - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Rocket Loader + - **Value**: Off 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -1392,18 +1290,14 @@ You configured a Page Rule setting Security Level to _I'm Under Attack_ for all 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to set Security Level to _I'm Under Attack_, for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: Security Level - - **Select Security Level**: _I'm Under Attack_ - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: Security Level + - **Select Security Level**: _I'm Under Attack_ 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. @@ -1459,18 +1353,14 @@ You configured a Page Rule setting SSL to _Strict_ for all subdomains of `exampl 1. [Create a configuration rule](/rules/configuration-rules/create-dashboard/) to set SSL to _Strict_, for any hostname containing `example.com`: -
- - **When incoming requests match**: Custom filter expression - - Using the Expression Builder:
- `Hostname contains "example.com"` - - Using the Expression Editor:
- `(http.host contains "example.com")` - - - **Then the settings are**: - - **Setting**: SSL - - **Select SSL/TLS encryption mode**: _Strict_ - -
+- **When incoming requests match**: Custom filter expression + - Using the Expression Builder:
+ `Hostname contains "example.com"` + - Using the Expression Editor:
+ `(http.host contains "example.com")` +- **Then the settings are**: + - **Setting**: SSL + - **Select SSL/TLS encryption mode**: _Strict_ 2. Turn off your existing Page Rule and validate the behavior of the configuration rule you created. diff --git a/src/content/docs/rules/snippets/index.mdx b/src/content/docs/rules/snippets/index.mdx index 52ff5c38351e7f2..4284d6ce93db2c8 100644 --- a/src/content/docs/rules/snippets/index.mdx +++ b/src/content/docs/rules/snippets/index.mdx @@ -18,6 +18,7 @@ For code samples addressing common use cases, please refer to the [Examples](/ru diff --git a/src/content/docs/rules/transform/index.mdx b/src/content/docs/rules/transform/index.mdx index 25ebb9497946ea6..c881b3175b72c2b 100644 --- a/src/content/docs/rules/transform/index.mdx +++ b/src/content/docs/rules/transform/index.mdx @@ -18,12 +18,14 @@ There are several types of Transform Rules:
@@ -67,10 +69,12 @@ Request and response fields are immutable within each [phase](/ruleset-engine/ab diff --git a/src/content/docs/rules/transform/request-header-modification/create-api.mdx b/src/content/docs/rules/transform/request-header-modification/create-api.mdx index 32a90eea1b41672..55001ac428fd225 100644 --- a/src/content/docs/rules/transform/request-header-modification/create-api.mdx +++ b/src/content/docs/rules/transform/request-header-modification/create-api.mdx @@ -25,6 +25,7 @@ When creating a request header transform rule via API, make sure you: + @@ -167,7 +172,11 @@ The following example sets the rules of an existing phase ruleset (`$RULESET_ID` } ``` - + @@ -233,7 +242,11 @@ The following example sets the rules of an existing phase ruleset (`$RULESET_ID` } ``` - + diff --git a/src/content/docs/rules/transform/request-header-modification/index.mdx b/src/content/docs/rules/transform/request-header-modification/index.mdx index f0d2462528b6113..5fa68411b5d56c6 100644 --- a/src/content/docs/rules/transform/request-header-modification/index.mdx +++ b/src/content/docs/rules/transform/request-header-modification/index.mdx @@ -44,6 +44,7 @@ You can create a request header transform rule [in the dashboard](/rules/transfo @@ -67,5 +68,6 @@ You can create a request header transform rule [in the dashboard](/rules/transfo diff --git a/src/content/docs/rules/transform/request-header-modification/reference/fields-functions.mdx b/src/content/docs/rules/transform/request-header-modification/reference/fields-functions.mdx index b68192c88c4111b..7eedc9a4a8a095d 100644 --- a/src/content/docs/rules/transform/request-header-modification/reference/fields-functions.mdx +++ b/src/content/docs/rules/transform/request-header-modification/reference/fields-functions.mdx @@ -12,6 +12,10 @@ import { Render } from "~/components"; The available fields when setting an HTTP request header value using an expression are the following: - + For information on the available functions, refer to [Functions](/ruleset-engine/rules-language/functions/). diff --git a/src/content/docs/rules/transform/response-header-modification/create-api.mdx b/src/content/docs/rules/transform/response-header-modification/create-api.mdx index a35f2dfa48438f6..71ffd072a8d956d 100644 --- a/src/content/docs/rules/transform/response-header-modification/create-api.mdx +++ b/src/content/docs/rules/transform/response-header-modification/create-api.mdx @@ -24,6 +24,7 @@ When creating a response header transform rule via API, make sure you: + @@ -166,7 +171,11 @@ The following example configures the rules of an existing phase ruleset (`$RULES } ``` - + @@ -234,7 +243,11 @@ The following example configures the rules of an existing phase ruleset (`$RULES } ``` - + @@ -300,7 +313,11 @@ The following example sets the rules of an existing phase ruleset (`$RULESET_ID` } ``` - + diff --git a/src/content/docs/rules/transform/response-header-modification/index.mdx b/src/content/docs/rules/transform/response-header-modification/index.mdx index b7568b9a57cf7d3..6b3351140bf0cf3 100644 --- a/src/content/docs/rules/transform/response-header-modification/index.mdx +++ b/src/content/docs/rules/transform/response-header-modification/index.mdx @@ -45,6 +45,7 @@ You can create a response header transform rule [in the dashboard](/rules/transf @@ -72,5 +73,6 @@ You can create a response header transform rule [in the dashboard](/rules/transf diff --git a/src/content/docs/rules/transform/response-header-modification/reference/fields-functions.mdx b/src/content/docs/rules/transform/response-header-modification/reference/fields-functions.mdx index 3c603e09a7f5651..860c5ee9ff5d0e4 100644 --- a/src/content/docs/rules/transform/response-header-modification/reference/fields-functions.mdx +++ b/src/content/docs/rules/transform/response-header-modification/reference/fields-functions.mdx @@ -12,6 +12,10 @@ import { Render } from "~/components"; The available fields when setting an HTTP response header value using an expression are the following: - + For information on the available functions, refer to [Functions](/ruleset-engine/rules-language/functions/). diff --git a/src/content/docs/rules/transform/url-rewrite/create-api.mdx b/src/content/docs/rules/transform/url-rewrite/create-api.mdx index 1daaea5870a0d5a..d0b3f56f3d274fc 100644 --- a/src/content/docs/rules/transform/url-rewrite/create-api.mdx +++ b/src/content/docs/rules/transform/url-rewrite/create-api.mdx @@ -24,6 +24,7 @@ When creating a URL rewrite rule via API, make sure you: + @@ -162,7 +167,11 @@ The following example sets the rules of an existing phase ruleset (`$RULESET_ID` } ``` - + diff --git a/src/content/docs/rules/transform/url-rewrite/index.mdx b/src/content/docs/rules/transform/url-rewrite/index.mdx index 224e0045d0881cc..bd4a3b711a41a8c 100644 --- a/src/content/docs/rules/transform/url-rewrite/index.mdx +++ b/src/content/docs/rules/transform/url-rewrite/index.mdx @@ -21,7 +21,11 @@ Use a URL rewrite rule to return the content of a URL while displaying a differe You cannot rewrite the hostname using a URL rewrite rule. To rewrite the hostname, use an [origin rule](/rules/origin-rules/features/#dns-record). - + ::: @@ -40,5 +44,6 @@ When using Cloudflare Images, you can use URL Rewrite Rules to serve images from diff --git a/src/content/docs/rules/url-forwarding/bulk-redirects/create-api.mdx b/src/content/docs/rules/url-forwarding/bulk-redirects/create-api.mdx index 6152657de875e2c..b35fe826eb60353 100644 --- a/src/content/docs/rules/url-forwarding/bulk-redirects/create-api.mdx +++ b/src/content/docs/rules/url-forwarding/bulk-redirects/create-api.mdx @@ -17,6 +17,7 @@ To create Bulk Redirects via API, you must: @@ -189,7 +190,11 @@ The following request of the [Create an account ruleset](/api/resources/rulesets } ``` - + If there is already a phase entry point ruleset for the `http_request_redirect` phase, use the [Update an account ruleset](/api/resources/rulesets/methods/update/) operation instead, like in the following example: diff --git a/src/content/docs/rules/url-forwarding/bulk-redirects/create-dashboard.mdx b/src/content/docs/rules/url-forwarding/bulk-redirects/create-dashboard.mdx index d5124c197001fc8..adaf42d00e47215 100644 --- a/src/content/docs/rules/url-forwarding/bulk-redirects/create-dashboard.mdx +++ b/src/content/docs/rules/url-forwarding/bulk-redirects/create-dashboard.mdx @@ -22,6 +22,7 @@ However, the lists and rules only exist at the account level and every zone in t diff --git a/src/content/docs/rules/url-forwarding/bulk-redirects/index.mdx b/src/content/docs/rules/url-forwarding/bulk-redirects/index.mdx index a2e443ed33212ee..e064a51390c035b 100644 --- a/src/content/docs/rules/url-forwarding/bulk-redirects/index.mdx +++ b/src/content/docs/rules/url-forwarding/bulk-redirects/index.mdx @@ -16,6 +16,7 @@ Unlike dynamic URL redirects created in [Single Redirects](/rules/url-forwarding diff --git a/src/content/docs/rules/url-forwarding/index.mdx b/src/content/docs/rules/url-forwarding/index.mdx index 8d50eb8f82ac9e2..8de4a0c68f71304 100644 --- a/src/content/docs/rules/url-forwarding/index.mdx +++ b/src/content/docs/rules/url-forwarding/index.mdx @@ -19,6 +19,7 @@ Use the following Cloudflare products to perform URL redirects, according to you @@ -54,5 +55,6 @@ Single Redirects features and quotas are per zone and depend on the zone plan. diff --git a/src/content/docs/rules/url-forwarding/single-redirects/create-api.mdx b/src/content/docs/rules/url-forwarding/single-redirects/create-api.mdx index 291a24f2aa1929a..4bb853561de7834 100644 --- a/src/content/docs/rules/url-forwarding/single-redirects/create-api.mdx +++ b/src/content/docs/rules/url-forwarding/single-redirects/create-api.mdx @@ -14,6 +14,7 @@ Add redirect rules to the entry point ruleset of the `http_request_dynamic_redir @@ -97,7 +98,11 @@ The following request of the [Create a zone ruleset](/api/resources/rulesets/met - + If there is already a phase entry point ruleset for the `http_request_dynamic_redirect` phase, use the [Update a zone ruleset](/api/resources/rulesets/methods/update/) operation instead, like in the following example: diff --git a/src/content/docs/rules/url-forwarding/single-redirects/create-dashboard.mdx b/src/content/docs/rules/url-forwarding/single-redirects/create-dashboard.mdx index c56889dd4b23c46..7ea07d1d1db6e92 100644 --- a/src/content/docs/rules/url-forwarding/single-redirects/create-dashboard.mdx +++ b/src/content/docs/rules/url-forwarding/single-redirects/create-dashboard.mdx @@ -31,5 +31,6 @@ import { Render } from "~/components"; diff --git a/src/content/docs/rules/url-forwarding/single-redirects/index.mdx b/src/content/docs/rules/url-forwarding/single-redirects/index.mdx index b7430dbd38bbe52..4ef885c32eb18b2 100644 --- a/src/content/docs/rules/url-forwarding/single-redirects/index.mdx +++ b/src/content/docs/rules/url-forwarding/single-redirects/index.mdx @@ -14,6 +14,7 @@ Single Redirects allow you to create static or dynamic URL diff --git a/src/content/docs/rules/url-forwarding/single-redirects/terraform-example.mdx b/src/content/docs/rules/url-forwarding/single-redirects/terraform-example.mdx index 51468677e0fad15..e6d66d486dcc67a 100644 --- a/src/content/docs/rules/url-forwarding/single-redirects/terraform-example.mdx +++ b/src/content/docs/rules/url-forwarding/single-redirects/terraform-example.mdx @@ -39,6 +39,10 @@ resource "cloudflare_ruleset" "single_redirects_example" { } ``` - + diff --git a/src/content/docs/ruleset-engine/rules-language/values.mdx b/src/content/docs/ruleset-engine/rules-language/values.mdx index 013abc89491547d..8bb2e85999939b5 100644 --- a/src/content/docs/ruleset-engine/rules-language/values.mdx +++ b/src/content/docs/ruleset-engine/rules-language/values.mdx @@ -157,6 +157,7 @@ It is not possible to define your own arrays. You can only use arrays returned b @@ -228,6 +229,7 @@ It is not possible to define your own maps. You can only use maps returned by fi @@ -255,7 +257,6 @@ Additionally, for some data types you can use ranges as elements: - For integer values, enter ranges in the form `..`. An inline list can contain both integer ranges and integer values. - For IP addresses, you can enter: - - Explicit IP ranges in the form `..` (for example, `198.51.100.3..198.51.100.7`). - CIDR ranges (for example, `192.0.2.0/24` or `2001:0db8::/32`). diff --git a/src/content/docs/ssl/keyless-ssl/configuration/cloudflare-tunnel.mdx b/src/content/docs/ssl/keyless-ssl/configuration/cloudflare-tunnel.mdx index 2d2c25c36d4204f..e0a20d5ebd84d5d 100644 --- a/src/content/docs/ssl/keyless-ssl/configuration/cloudflare-tunnel.mdx +++ b/src/content/docs/ssl/keyless-ssl/configuration/cloudflare-tunnel.mdx @@ -60,5 +60,6 @@ When you receive the `network` value from the Tunnel route API, it will include diff --git a/src/content/docs/ssl/keyless-ssl/configuration/public-dns.mdx b/src/content/docs/ssl/keyless-ssl/configuration/public-dns.mdx index d183f14134bf96e..9a74d03d9c81e36 100644 --- a/src/content/docs/ssl/keyless-ssl/configuration/public-dns.mdx +++ b/src/content/docs/ssl/keyless-ssl/configuration/public-dns.mdx @@ -67,6 +67,7 @@ To create a Keyless certificate with the API, send a [`POST`](/api/resources/key diff --git a/src/content/docs/ssl/origin-configuration/authenticated-origin-pull/set-up/per-hostname.mdx b/src/content/docs/ssl/origin-configuration/authenticated-origin-pull/set-up/per-hostname.mdx index 2201bca9fa65934..7a20a1d4c6d73f9 100644 --- a/src/content/docs/ssl/origin-configuration/authenticated-origin-pull/set-up/per-hostname.mdx +++ b/src/content/docs/ssl/origin-configuration/authenticated-origin-pull/set-up/per-hostname.mdx @@ -40,7 +40,11 @@ In the API response, save the certificate `id` since it will be required in step ## 2. Configure origin to accept client certificates - + ## 3. Enable Authenticated Origin Pulls (globally) diff --git a/src/content/docs/ssl/origin-configuration/authenticated-origin-pull/set-up/zone-level.mdx b/src/content/docs/ssl/origin-configuration/authenticated-origin-pull/set-up/zone-level.mdx index e484e5c0fd214ad..1e97f1a984b9a1f 100644 --- a/src/content/docs/ssl/origin-configuration/authenticated-origin-pull/set-up/zone-level.mdx +++ b/src/content/docs/ssl/origin-configuration/authenticated-origin-pull/set-up/zone-level.mdx @@ -43,6 +43,7 @@ Using a custom certificate is required if you need your domain to be [FIPS](http + ``` ## Starlight @@ -25,14 +25,19 @@ The Starlight icon set is available to use in `Tab`, `Card` and other Starlight ```mdx live import { StarlightIcon } from "~/components"; - + ``` ## Icon library \ No newline at end of file +/> diff --git a/src/content/docs/style-guide/components/render.mdx b/src/content/docs/style-guide/components/render.mdx index bcee052aef4f7d2..c325a43b2e09f36 100644 --- a/src/content/docs/style-guide/components/render.mdx +++ b/src/content/docs/style-guide/components/render.mdx @@ -17,6 +17,7 @@ import { Render } from "~/components"; + ``` ### Properties in Markdown syntax @@ -116,7 +117,11 @@ import strongRaw from "~/content/partials/style-guide/strong-in-props.mdx?raw"; ```mdx live import { Render } from "~/components"; - + ``` #### Links @@ -132,6 +137,7 @@ import { Render } from "~/components"; + ``` #### Code blocks @@ -163,7 +173,11 @@ import codeRaw from "~/content/partials/style-guide/code-in-props.mdx?raw"; ```mdx live import { Render } from "~/components"; - + ``` ### Properties to render content conditionally @@ -181,15 +195,27 @@ import optionalRaw from "~/content/partials/style-guide/optional-props.mdx?raw"; ```mdx live import { Render } from "~/components"; - +
- +
- + ``` ## Partials diff --git a/src/content/docs/style-guide/components/tabs.mdx b/src/content/docs/style-guide/components/tabs.mdx index 6f9e8e4004f56ce..614a197f3b22c55 100644 --- a/src/content/docs/style-guide/components/tabs.mdx +++ b/src/content/docs/style-guide/components/tabs.mdx @@ -4,7 +4,7 @@ styleGuide: component: Tabs --- -import { Tabs, TabItem, Render } from '~/components'; +import { Tabs, TabItem, Render } from "~/components"; This component can help you create a tabbed interface to show related information more efficiently. Use it when there are different ways of getting the same thing done: @@ -13,24 +13,24 @@ This component can help you create a tabbed interface to show related informatio - Account-level vs zone-level navigation - GRE / IPsec tunnels - ```mdx live -import { Tabs, TabItem } from '~/components'; +import { Tabs, TabItem } from "~/components"; - - Sirius, Vega, Betelgeuse - - - Io, Europa, Ganymede - + + Sirius, Vega, Betelgeuse + + + Io, Europa, Ganymede + ``` -### Tab icons +### Tab icons @@ -59,7 +59,6 @@ Dash instructions API instructions - ``` Will synchronize with: @@ -72,4 +71,4 @@ Dash instructions API instructions - \ No newline at end of file + diff --git a/src/content/docs/terraform/additional-configurations/rate-limiting-rules.mdx b/src/content/docs/terraform/additional-configurations/rate-limiting-rules.mdx index d4eb59b42fc9440..82c2e4acdcfeb96 100644 --- a/src/content/docs/terraform/additional-configurations/rate-limiting-rules.mdx +++ b/src/content/docs/terraform/additional-configurations/rate-limiting-rules.mdx @@ -63,7 +63,11 @@ resource "cloudflare_ruleset" "zone_rl" { } ``` - +
## Create a rate limiting rule at the account level @@ -125,7 +129,11 @@ resource "cloudflare_ruleset" "account_rl_entrypoint" { } ``` - +
## Create an advanced rate limiting rule @@ -168,5 +176,9 @@ resource "cloudflare_ruleset" "zone_rl_custom_response" { } ``` - +
diff --git a/src/content/docs/terraform/additional-configurations/transform-rules.mdx b/src/content/docs/terraform/additional-configurations/transform-rules.mdx index 4a561eecca63a3f..7ec3a20f8c6c2a3 100644 --- a/src/content/docs/terraform/additional-configurations/transform-rules.mdx +++ b/src/content/docs/terraform/additional-configurations/transform-rules.mdx @@ -69,7 +69,12 @@ resource "cloudflare_ruleset" "transform_url_rewrite" { -
+ +
For more information on rewriting URLs, refer to [URL Rewrite Rules](/rules/transform/url-rewrite/). @@ -120,6 +125,7 @@ resource "cloudflare_ruleset" "transform_modify_request_headers" { @@ -172,6 +178,7 @@ resource "cloudflare_ruleset" "transform_modify_response_headers" { diff --git a/src/content/docs/terraform/additional-configurations/waf-custom-rules.mdx b/src/content/docs/terraform/additional-configurations/waf-custom-rules.mdx index ad68c039b28862e..62c642a517ff6e5 100644 --- a/src/content/docs/terraform/additional-configurations/waf-custom-rules.mdx +++ b/src/content/docs/terraform/additional-configurations/waf-custom-rules.mdx @@ -60,7 +60,12 @@ resource "cloudflare_ruleset" "zone_custom_firewall" { } ``` -
+ +
## Create and deploy a custom ruleset (account-level configuration) {/* create-and-deploy-a-custom-ruleset */} @@ -95,6 +100,7 @@ resource "cloudflare_ruleset" "account_firewall_custom_ruleset" {
diff --git a/src/content/docs/waf/account/custom-rulesets/create-api.mdx b/src/content/docs/waf/account/custom-rulesets/create-api.mdx index cffb46df6b9de5a..d89270ed34fef50 100644 --- a/src/content/docs/waf/account/custom-rulesets/create-api.mdx +++ b/src/content/docs/waf/account/custom-rulesets/create-api.mdx @@ -59,6 +59,7 @@ To deploy the custom ruleset, add a rule with `"action": "execute"` to the `http 1. @@ -93,6 +94,7 @@ To deploy the custom ruleset, add a rule with `"action": "execute"` to the `http 2. @@ -112,6 +113,7 @@ To deploy the rate limiting ruleset, add a rule with `"action": "execute"` to th 2. @@ -93,6 +94,7 @@ This example deploys the Cloudflare Exposed Credentials Check Managed Ruleset to 2. @@ -107,6 +108,7 @@ This example deploys the Cloudflare Sensitive Data Detection managed ruleset to 2. diff --git a/src/content/docs/waf/rate-limiting-rules/create-zone-dashboard.mdx b/src/content/docs/waf/rate-limiting-rules/create-zone-dashboard.mdx index 937d9a93d39445b..fe7129115b7ad5f 100644 --- a/src/content/docs/waf/rate-limiting-rules/create-zone-dashboard.mdx +++ b/src/content/docs/waf/rate-limiting-rules/create-zone-dashboard.mdx @@ -102,6 +102,7 @@ This feature is only available on Pro plans and above. + [^1]: Due to a technical limitation that we hope to address in the future, the `CF-Cache-Status` header is not always entirely accurate. It is possible for false-positives and false-negatives to occur. This should be rare. In the meantime, this header should be considered as returning a "probablistic" result. diff --git a/src/content/docs/workers/static-assets/redirects.mdx b/src/content/docs/workers/static-assets/redirects.mdx index 4002258ac9e3906..800f9ce4f897e28 100644 --- a/src/content/docs/workers/static-assets/redirects.mdx +++ b/src/content/docs/workers/static-assets/redirects.mdx @@ -7,4 +7,4 @@ sidebar: import { Render } from "~/components"; - + diff --git a/src/content/docs/workers/static-assets/routing/single-page-application.mdx b/src/content/docs/workers/static-assets/routing/single-page-application.mdx index 35fa83a613b2de5..87ff725b0dcc4a2 100644 --- a/src/content/docs/workers/static-assets/routing/single-page-application.mdx +++ b/src/content/docs/workers/static-assets/routing/single-page-application.mdx @@ -94,5 +94,6 @@ If you are using a Vite-powered SPA framework, you might be interested in using diff --git a/src/content/docs/workers/static-assets/routing/static-site-generation.mdx b/src/content/docs/workers/static-assets/routing/static-site-generation.mdx index f65d5a0f8d273ff..2f9d9e13b6340a8 100644 --- a/src/content/docs/workers/static-assets/routing/static-site-generation.mdx +++ b/src/content/docs/workers/static-assets/routing/static-site-generation.mdx @@ -46,5 +46,6 @@ If you are using a Vite-powered SPA framework, you might be interested in using diff --git a/src/content/docs/workflows/build/events-and-parameters.mdx b/src/content/docs/workflows/build/events-and-parameters.mdx index 06b94b9d7e6e684..fecaf1e1845a1bb 100644 --- a/src/content/docs/workflows/build/events-and-parameters.mdx +++ b/src/content/docs/workflows/build/events-and-parameters.mdx @@ -3,10 +3,15 @@ title: Events and parameters pcx_content_type: concept sidebar: order: 6 - --- -import { MetaInfo, Render, Type, WranglerConfig, TypeScriptExample } from "~/components"; +import { + MetaInfo, + Render, + Type, + WranglerConfig, + TypeScriptExample, +} from "~/components"; When a Workflow is triggered, it can receive an optional event. This event can include data that your Workflow can act on, including request details, user data fetched from your database (such as D1 or KV) or from a webhook, or messages from a Queue consumer. @@ -16,9 +21,9 @@ Events are a powerful part of a Workflow, as you often want a Workflow to act on You can pass parameters to a Workflow in three ways: -* As an optional argument to the `create` method on a [Workflow binding](/workers/wrangler/commands/#trigger) when triggering a Workflow from a Worker. -* Via the `--params` flag when using the `wrangler` CLI to trigger a Workflow. -* Via the `step.waitForEvent` API, which allows a Workflow instance to wait for an event (and optional data) to be received _while it is running_. Workflow instances can be sent events from external services over HTTP or via the Workers API for Workflows. +- As an optional argument to the `create` method on a [Workflow binding](/workers/wrangler/commands/#trigger) when triggering a Workflow from a Worker. +- Via the `--params` flag when using the `wrangler` CLI to trigger a Workflow. +- Via the `step.waitForEvent` API, which allows a Workflow instance to wait for an event (and optional data) to be received _while it is running_. Workflow instances can be sent events from external services over HTTP or via the Workers API for Workflows. You can pass any JSON-serializable object as a parameter. @@ -34,21 +39,21 @@ Store state durably by returning it from your `step.do` callbacks. ```ts export default { - async fetch(req: Request, env: Env) { - let someEvent = { url: req.url, createdTimestamp: Date.now() } - // Trigger our Workflow - // Pass our event as the second parameter to the `create` method - // on our Workflow binding. - let instance = await env.MY_WORKFLOW.create({ - id: crypto.randomUUID(), - params: someEvent - }); - - return Response.json({ - id: instance.id, - details: await instance.status(), - }); - }, + async fetch(req: Request, env: Env) { + let someEvent = { url: req.url, createdTimestamp: Date.now() }; + // Trigger our Workflow + // Pass our event as the second parameter to the `create` method + // on our Workflow binding. + let instance = await env.MY_WORKFLOW.create({ + id: crypto.randomUUID(), + params: someEvent, + }); + + return Response.json({ + id: instance.id, + details: await instance.status(), + }); + }, }; ``` @@ -59,6 +64,7 @@ To pass parameters via the `wrangler` command-line interface, pass a JSON string ```sh npx wrangler@latest workflows trigger workflows-starter '{"some":"data"}' ``` + ```sh output 🚀 Workflow instance "57c7913b-8e1d-4a78-a0dd-dce5a0b7aa30" has been queued successfully ``` @@ -82,7 +88,10 @@ For example, to wait for billing webhook: export class MyWorkflow extends WorkflowEntrypoint { async run(event: WorkflowEvent, step: WorkflowStep) { // Other steps in your Workflow - let event = await step.waitForEvent("receive invoice paid webhook from Stripe", { type: "stripe-webhook", timeout: "1 hour" }) + let event = await step.waitForEvent( + "receive invoice paid webhook from Stripe", + { type: "stripe-webhook", timeout: "1 hour" }, + ); // Rest of your Workflow } } @@ -92,9 +101,9 @@ export class MyWorkflow extends WorkflowEntrypoint { The above example: -* Calls `waitForEvent` with a `type` of `stripe-webhook` - the corresponding `sendEvent` call would thus be `await instance.sendEvent({type: "stripe-webhook", payload: webhookPayload})`. -* Uses a TypeScript [type parameter](https://www.typescriptlang.org/docs/handbook/2/generics.html) to type the return value of `step.waitForEvent` as our `IncomingStripeWebhook`. -* Continues on with the rest of the Workflow. +- Calls `waitForEvent` with a `type` of `stripe-webhook` - the corresponding `sendEvent` call would thus be `await instance.sendEvent({type: "stripe-webhook", payload: webhookPayload})`. +- Uses a TypeScript [type parameter](https://www.typescriptlang.org/docs/handbook/2/generics.html) to type the return value of `step.waitForEvent` as our `IncomingStripeWebhook`. +- Continues on with the rest of the Workflow. ### Send events to running workflows @@ -104,27 +113,30 @@ Workflow instances that are waiting on events using the `waitForEvent` API can b ```ts export default { - async fetch(req: Request, env: Env) { - const instanceId = new URL(req.url).searchParams.get("instanceId") - const webhookPayload = await req.json() - - let instance = await env.MY_WORKFLOW.get(instanceId); - // Send our event, with `type` matching the event type defined in - // our step.waitForEvent call - await instance.sendEvent({type: "stripe-webhook", payload: webhookPayload}) - - return Response.json({ - status: await instance.status(), - }); - }, + async fetch(req: Request, env: Env) { + const instanceId = new URL(req.url).searchParams.get("instanceId"); + const webhookPayload = await req.json(); + + let instance = await env.MY_WORKFLOW.get(instanceId); + // Send our event, with `type` matching the event type defined in + // our step.waitForEvent call + await instance.sendEvent({ + type: "stripe-webhook", + payload: webhookPayload, + }); + + return Response.json({ + status: await instance.status(), + }); + }, }; ``` -* Similar to the [`waitForEvent`](#wait-for-events) example in this guide, the `type` property in our `waitForEvent` and `sendEvent` fields must match. -* To send multiple events to a Workflow that has multiple `waitForEvent` calls, call `sendEvent` with the corresponding `type` property set. -* Events can also be sent using the REST API (HTTP API)'s [Events endpoint](/api/resources/workflows/subresources/instances/subresources/events/methods/create/). +- Similar to the [`waitForEvent`](#wait-for-events) example in this guide, the `type` property in our `waitForEvent` and `sendEvent` fields must match. +- To send multiple events to a Workflow that has multiple `waitForEvent` calls, call `sendEvent` with the corresponding `type` property set. +- Events can also be sent using the REST API (HTTP API)'s [Events endpoint](/api/resources/workflows/subresources/instances/subresources/events/methods/create/). ## TypeScript and type parameters @@ -132,12 +144,12 @@ By default, the `WorkflowEvent` passed to the `run` method of your Workflow defi ```ts export type WorkflowEvent = { - // The data passed as the parameter when the Workflow instance was triggered - payload: T; - // The timestamp that the Workflow was triggered - timestamp: Date; - // ID of the current Workflow instance - instanceId: string; + // The data passed as the parameter when the Workflow instance was triggered + payload: T; + // The timestamp that the Workflow was triggered + timestamp: Date; + // ID of the current Workflow instance + instanceId: string; }; ``` @@ -147,9 +159,9 @@ You can optionally type these events by defining your own type and passing it as // Define a type that conforms to the events your Workflow instance is // instantiated with interface YourEventType { - userEmail: string; - createdTimestamp: number; - metadata?: Record; + userEmail: string; + createdTimestamp: number; + metadata?: Record; } ``` @@ -174,4 +186,4 @@ export class MyWorkflow extends WorkflowEntrypoint { } ``` - + diff --git a/src/content/docs/workflows/build/workers-api.mdx b/src/content/docs/workflows/build/workers-api.mdx index cf8655ad809eac8..88a3dadb2aaa5fe 100644 --- a/src/content/docs/workflows/build/workers-api.mdx +++ b/src/content/docs/workflows/build/workers-api.mdx @@ -3,10 +3,15 @@ title: Workers API pcx_content_type: concept sidebar: order: 2 - --- -import { MetaInfo, Render, Type, TypeScriptExample, WranglerConfig } from "~/components"; +import { + MetaInfo, + Render, + Type, + TypeScriptExample, + WranglerConfig, +} from "~/components"; This guide details the Workflows API within Cloudflare Workers, including methods, types, and usage examples. @@ -17,30 +22,30 @@ The `WorkflowEntrypoint` class is the core element of a Workflow definition. A W ```ts export class MyWorkflow extends WorkflowEntrypoint { async run(event: WorkflowEvent, step: WorkflowStep) { - // Steps here + // Steps here } -}; +} ``` ### run -* run(event: WorkflowEvent<T>, step: WorkflowStep): Promise<T> - - * `event` - the event passed to the Workflow, including an optional `payload` containing data (parameters) - * `step` - the `WorkflowStep` type that provides the step methods for your Workflow +{/* prettier-ignore */} +- run(event: WorkflowEvent<T>, step: WorkflowStep): Promise<T> + - `event` - the event passed to the Workflow, including an optional `payload` containing data (parameters) + - `step` - the `WorkflowStep` type that provides the step methods for your Workflow The `run` method can optionally return data, which is available when querying the instance status via the [Workers API](/workflows/build/workers-api/#instancestatus), [REST API](/api/resources/workflows/subresources/instances/subresources/status/) and the Workflows dashboard. This can be useful if your Workflow is computing a result, returning the key to data stored in object storage, or generating some kind of identifier you need to act on. ```ts export class MyWorkflow extends WorkflowEntrypoint { async run(event: WorkflowEvent, step: WorkflowStep) { - // Steps here - let someComputedState = await step.do("my step", async () => { }) + // Steps here + let someComputedState = await step.do("my step", async () => {}); // Optional: return state from our run() method - return someComputedState + return someComputedState; } -}; +} ``` The `WorkflowEvent` type accepts an optional [type parameter](https://www.typescriptlang.org/docs/handbook/2/generics.html#working-with-generic-type-variables) that allows you to provide a type for the `payload` property within the `WorkflowEvent`. @@ -53,17 +58,16 @@ Finally, any JS control-flow primitive (if conditions, loops, try-catches, promi ```ts export type WorkflowEvent = { - payload: Readonly; - timestamp: Date; - instanceId: string; + payload: Readonly; + timestamp: Date; + instanceId: string; }; ``` -* The `WorkflowEvent` is the first argument to a Workflow's `run` method, and includes an optional `payload` parameter and a `timestamp` property. - - * `payload` - a default type of `any` or type `T` if a type parameter is provided. - * `timestamp` - a `Date` object set to the time the Workflow instance was created (triggered). - * `instanceId` - the ID of the associated instance. +- The `WorkflowEvent` is the first argument to a Workflow's `run` method, and includes an optional `payload` parameter and a `timestamp` property. + - `payload` - a default type of `any` or type `T` if a type parameter is provided. + - `timestamp` - a `Date` object set to the time the Workflow instance was created (triggered). + - `instanceId` - the ID of the associated instance. Refer to the [events and parameters](/workflows/build/events-and-parameters/) documentation for how to handle events within your Workflow code. @@ -71,12 +75,13 @@ Refer to the [events and parameters](/workflows/build/events-and-parameters/) do ### step -* step.do(name: string, callback: (): RpcSerializable): Promise<T> -* step.do(name: string, config?: WorkflowStepConfig, callback: (): RpcSerializable): Promise<T> - - * `name` - the name of the step. - * `config` (optional) - an optional `WorkflowStepConfig` for configuring [step specific retry behaviour](/workflows/build/sleeping-and-retrying/). - * `callback` - an asynchronous function that optionally returns serializable state for the Workflow to persist. +{/* prettier-ignore */} +- step.do(name: string, callback: (): RpcSerializable): Promise<T> +- step.do(name: string, config?: WorkflowStepConfig, callback: (): + RpcSerializable): Promise<T> + - `name` - the name of the step. + - `config` (optional) - an optional `WorkflowStepConfig` for configuring [step specific retry behaviour](/workflows/build/sleeping-and-retrying/). + - `callback` - an asynchronous function that optionally returns serializable state for the Workflow to persist. :::note[Returning state] @@ -88,16 +93,16 @@ Objects that include `Function` or `Symbol` types, and objects with circular ref ::: -* step.sleep(name: string, duration: WorkflowDuration): Promise<void> - - * `name` - the name of the step. - * `duration` - the duration to sleep until, in either seconds or as a `WorkflowDuration` compatible string. - * Refer to the [documentation on sleeping and retrying](/workflows/build/sleeping-and-retrying/) to learn more about how Workflows are retried. +{/* prettier-ignore */} +- step.sleep(name: string, duration: WorkflowDuration): Promise<void> + - `name` - the name of the step. + - `duration` - the duration to sleep until, in either seconds or as a `WorkflowDuration` compatible string. + - Refer to the [documentation on sleeping and retrying](/workflows/build/sleeping-and-retrying/) to learn more about how Workflows are retried. -* step.sleepUntil(name: string, timestamp: Date | number): Promise<void> - - * `name` - the name of the step. - * `timestamp` - a JavaScript `Date` object or seconds from the Unix epoch to sleep the Workflow instance until. +{/* prettier-ignore */} +- step.sleepUntil(name: string, timestamp: Date | number): Promise<void> + - `name` - the name of the step. + - `timestamp` - a JavaScript `Date` object or seconds from the Unix epoch to sleep the Workflow instance until. :::note @@ -107,10 +112,9 @@ More information about the limits imposed on Workflow can be found in the [Workf ::: -* step.waitForEvent(name: string, options: ): Promise<void> - - * `name` - the name of the step. - * `options` - an object with properties for `type`, which determines which event type this `waitForEvent` call will match on when calling `instance.sendEvent`, and an optional `timeout` property, which defines how long the `waitForEvent` call will block for before throwing a timeout exception. The default timeout is 24 hours. +- step.waitForEvent(name: string, options: ): Promise<void> + - `name` - the name of the step. + - `options` - an object with properties for `type`, which determines which event type this `waitForEvent` call will match on when calling `instance.sendEvent`, and an optional `timeout` property, which defines how long the `waitForEvent` call will block for before throwing a timeout exception. The default timeout is 24 hours. @@ -118,7 +122,10 @@ More information about the limits imposed on Workflow can be found in the [Workf export class MyWorkflow extends WorkflowEntrypoint { async run(event: WorkflowEvent, step: WorkflowStep) { // Other steps in your Workflow - let event = await step.waitForEvent("receive invoice paid webhook from Stripe", { type: "stripe-webhook", timeout: "1 hour" }) + let event = await step.waitForEvent( + "receive invoice paid webhook from Stripe", + { type: "stripe-webhook", timeout: "1 hour" }, + ); // Rest of your Workflow } } @@ -132,25 +139,25 @@ Review the documentation on [events and parameters](/workflows/build/events-and- ```ts export type WorkflowStepConfig = { - retries?: { - limit: number; - delay: string | number; - backoff?: WorkflowBackoff; - }; - timeout?: string | number; + retries?: { + limit: number; + delay: string | number; + backoff?: WorkflowBackoff; + }; + timeout?: string | number; }; ``` -* A `WorkflowStepConfig` is an optional argument to the `do` method of a `WorkflowStep` and defines properties that allow you to configure the retry behaviour of that step. +- A `WorkflowStepConfig` is an optional argument to the `do` method of a `WorkflowStep` and defines properties that allow you to configure the retry behaviour of that step. Refer to the [documentation on sleeping and retrying](/workflows/build/sleeping-and-retrying/) to learn more about how Workflows are retried. ## NonRetryableError -* throw new NonRetryableError(message: , name ): - - * Throws an error that forces the current Workflow instance to fail and not be retried. - * Refer to the [documentation on sleeping and retrying](/workflows/build/sleeping-and-retrying/) to learn more about how Workflows are retried. +{/* prettier-ignore */} +- throw new NonRetryableError(message: , name ): + - Throws an error that forces the current Workflow instance to fail and not be retried. + - Refer to the [documentation on sleeping and retrying](/workflows/build/sleeping-and-retrying/) to learn more about how Workflows are retried. ## Call Workflows from Workers @@ -176,6 +183,7 @@ binding = "MY_WORKFLOW" # this is class that extends the Workflow class in src/index.ts class_name = "MyWorkflow" ``` + ### Bind from Pages @@ -227,8 +235,8 @@ It is part of the generated types produced by [`wrangler types`](/workers/wrangl ```ts title="./worker-configuration.d.ts" interface Env { - // The 'MY_WORKFLOW' variable should match the "binding" value set in the Wrangler config file - MY_WORKFLOW: Workflow; + // The 'MY_WORKFLOW' variable should match the "binding" value set in the Wrangler config file + MY_WORKFLOW: Workflow; } ``` @@ -238,9 +246,9 @@ The `Workflow` type exports the following methods: Create (trigger) a new instance of the given Workflow. -* create(options?: WorkflowInstanceCreateOptions): Promise<WorkflowInstance> - - * `options` - optional properties to pass when creating an instance, including a user-provided ID and payload parameters. +{/* prettier-ignore */} +- create(options?: WorkflowInstanceCreateOptions): Promise<WorkflowInstance> + - `options` - optional properties to pass when creating an instance, including a user-provided ID and payload parameters. An ID is automatically generated, but a user-provided ID can be specified (up to 64 characters [^1]). This can be useful when mapping Workflows to users, merchants or other identifiers in your system. You can also provide a JSON object as the `params` property, allowing you to pass data for the Workflow instance to act on as its [`WorkflowEvent`](/workflows/build/events-and-parameters/). @@ -248,8 +256,8 @@ An ID is automatically generated, but a user-provided ID can be specified (up to // Create a new Workflow instance with your own ID and pass params to the Workflow instance let instance = await env.MY_WORKFLOW.create({ id: myIdDefinedFromOtherSystem, - params: { "hello": "world" } -}) + params: { hello: "world" }, +}); return Response.json({ id: instance.id, details: await instance.status(), @@ -258,7 +266,7 @@ return Response.json({ Returns a `WorkflowInstance`. - + To provide an optional type parameter to the `Workflow`, pass a type argument with your type when defining your Workflow bindings: @@ -300,18 +308,18 @@ Create (trigger) a batch of new instance of the given Workflow, up to 100 instan This is useful when you are scheduling multiple instances at once. A call to `createBatch` is treated the same as a call to `create` (for a single instance) and allows you to work within the [instance creation limit](/workflows/reference/limits/). -* createBatch(batch: WorkflowInstanceCreateOptions[]): Promise<WorkflowInstance[]> - - * `batch` - list of Options to pass when creating an instance, including a user-provided ID and payload parameters. +{/* prettier-ignore */} +- createBatch(batch: WorkflowInstanceCreateOptions[]): Promise<WorkflowInstance[]> + - `batch` - list of Options to pass when creating an instance, including a user-provided ID and payload parameters. Each element of the `batch` list is expected to include both `id` and `params` properties: ```ts // Create a new batch of 3 Workflow instances, each with its own ID and pass params to the Workflow instances const listOfInstances = [ - { id: "id-abc123", params: { "hello": "world-0" } }, - { id: "id-def456", params: { "hello": "world-1" } }, - { id: "id-ghi789", params: { "hello": "world-2" } } + { id: "id-abc123", params: { hello: "world-0" } }, + { id: "id-def456", params: { hello: "world-1" } }, + { id: "id-ghi789", params: { hello: "world-2" } }, ]; let instances = await env.MY_WORKFLOW.createBatch(listOfInstances); ``` @@ -322,26 +330,25 @@ Returns an array of `WorkflowInstance`. Get a specific Workflow instance by ID. -* get(id: string): Promise<WorkflowInstance> - - * `id` - the ID of the Workflow instance. +- get(id: string): Promise<WorkflowInstance> + - `id` - the ID of the Workflow instance. Returns a `WorkflowInstance`. Throws an exception if the instance ID does not exist. ```ts // Fetch an existing Workflow instance by ID: try { - let instance = await env.MY_WORKFLOW.get(id) - return Response.json({ - id: instance.id, - details: await instance.status(), - }); + let instance = await env.MY_WORKFLOW.get(id); + return Response.json({ + id: instance.id, + details: await instance.status(), + }); } catch (e: any) { - // Handle errors - // .get will throw an exception if the ID doesn't exist or is invalid. - const msg = `failed to get instance ${id}: ${e.message}` - console.error(msg) - return Response.json({error: msg}, { status: 400 }) + // Handle errors + // .get will throw an exception if the ID doesn't exist or is invalid. + const msg = `failed to get instance ${id}: ${e.message}`; + console.error(msg); + return Response.json({ error: msg }, { status: 400 }); } ``` @@ -351,14 +358,14 @@ Optional properties to pass when creating an instance. ```ts interface WorkflowInstanceCreateOptions { - /** - * An id for your Workflow instance. Must be unique within the Workflow. - */ - id?: string; - /** - * The event payload the Workflow instance is triggered with - */ - params?: unknown; + /** + * An id for your Workflow instance. Must be unique within the Workflow. + */ + id?: string; + /** + * The event payload the Workflow instance is triggered with + */ + params?: unknown; } ``` @@ -368,27 +375,27 @@ Represents a specific instance of a Workflow, and provides methods to manage the ```ts declare abstract class WorkflowInstance { - public id: string; - /** - * Pause the instance. - */ - public pause(): Promise; - /** - * Resume the instance. If it is already running, an error will be thrown. - */ - public resume(): Promise; - /** - * Terminate the instance. If it is errored, terminated or complete, an error will be thrown. - */ - public terminate(): Promise; - /** - * Restart the instance. - */ - public restart(): Promise; - /** - * Returns the current status of the instance. - */ - public status(): Promise; + public id: string; + /** + * Pause the instance. + */ + public pause(): Promise; + /** + * Resume the instance. If it is already running, an error will be thrown. + */ + public resume(): Promise; + /** + * Terminate the instance. If it is errored, terminated or complete, an error will be thrown. + */ + public terminate(): Promise; + /** + * Restart the instance. + */ + public restart(): Promise; + /** + * Returns the current status of the instance. + */ + public status(): Promise; } ``` @@ -396,45 +403,44 @@ declare abstract class WorkflowInstance { Return the id of a Workflow. -* id: string +- id: string ### status Return the status of a running Workflow instance. -* status(): Promise<InstanceStatus> +- status(): Promise<InstanceStatus> ### pause Pause a running Workflow instance. -* pause(): Promise<void> +- pause(): Promise<void> ### resume Resume a paused Workflow instance. -* resume(): Promise<void> +- resume(): Promise<void> ### restart Restart a Workflow instance. -* restart(): Promise<void> +- restart(): Promise<void> ### terminate Terminate a Workflow instance. -* terminate(): Promise<void> +- terminate(): Promise<void> ### sendEvent [Send an event](/workflows/build/events-and-parameters/) to a running Workflow instance. -* sendEvent(): Promise<void> - - * `options` - the event `type` and `payload` to send to the Workflow instance. The `type` must match the `type` in the corresponding `waitForEvent` call in your Workflow. +- sendEvent(): Promise<void> + - `options` - the event `type` and `payload` to send to the Workflow instance. The `type` must match the `type` in the corresponding `waitForEvent` call in your Workflow. Return `void` on success; throws an exception if the Workflow is not running or is an errored state. @@ -442,19 +448,22 @@ Return `void` on success; throws an exception if the Workflow is not running or ```ts export default { - async fetch(req: Request, env: Env) { - const instanceId = new URL(req.url).searchParams.get("instanceId") - const webhookPayload = await req.json() - - let instance = await env.MY_WORKFLOW.get(instanceId); - // Send our event, with `type` matching the event type defined in - // our step.waitForEvent call - await instance.sendEvent({type: "stripe-webhook", payload: webhookPayload}) - - return Response.json({ - status: await instance.status(), - }); - }, + async fetch(req: Request, env: Env) { + const instanceId = new URL(req.url).searchParams.get("instanceId"); + const webhookPayload = await req.json(); + + let instance = await env.MY_WORKFLOW.get(instanceId); + // Send our event, with `type` matching the event type defined in + // our step.waitForEvent call + await instance.sendEvent({ + type: "stripe-webhook", + payload: webhookPayload, + }); + + return Response.json({ + status: await instance.status(), + }); + }, }; ``` @@ -470,19 +479,19 @@ Details the status of a Workflow instance. ```ts type InstanceStatus = { - status: - | "queued" // means that instance is waiting to be started (see concurrency limits) - | "running" - | "paused" - | "errored" - | "terminated" // user terminated the instance while it was running - | "complete" - | "waiting" // instance is hibernating and waiting for sleep or event to finish - | "waitingForPause" // instance is finishing the current work to pause - | "unknown"; - error?: string; - output?: object; + status: + | "queued" // means that instance is waiting to be started (see concurrency limits) + | "running" + | "paused" + | "errored" + | "terminated" // user terminated the instance while it was running + | "complete" + | "waiting" // instance is hibernating and waiting for sleep or event to finish + | "waitingForPause" // instance is finishing the current work to pause + | "unknown"; + error?: string; + output?: object; }; ``` -[^1]: Match pattern: _```^[a-zA-Z0-9_][a-zA-Z0-9-_]*$```_ +[^1]: Match pattern: `^[a-zA-Z0-9_][a-zA-Z0-9-_]*$`