From a46dd297970d3d0dfa9e777b23d0259231c471b0 Mon Sep 17 00:00:00 2001 From: warnessa Date: Fri, 26 Sep 2025 16:20:28 -0500 Subject: [PATCH 1/4] Create 2025-09-26-body-phase-selector.mdx --- .../dlp/2025-09-25-body-phase-selector.mdx | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx diff --git a/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx b/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx new file mode 100644 index 000000000000000..1d7d5adecec2b3d --- /dev/null +++ b/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx @@ -0,0 +1,23 @@ +--- +title: "Refine DLP Scans with New Body Phase Selector" +description: Gain more control over your DLP detections and reduce false positives by specifying whether to scan the HTTP request or response body. +date: 2025-09-25 +--- + +You can now more precisely control your HTTP DLP policies by specifying whether to scan the request or response body, helping to reduce false positives and target specific data flows. + + +In the Gateway HTTP policy builder, you will find a new optional selector called **Body Phase**. This allows you to define the direction of traffic the DLP engine will inspect: + + +* **Request Body**: Scans data sent *from* a user's machine to an upstream service. This is ideal for monitoring data uploads, form submissions, or other user-initiated data exfiltration attempts. +* **Response Body**: Scans data sent *to* a user's machine from an upstream service. Use this to inspect file downloads and website content for sensitive data. + + +For example, consider a policy that blocks Social Security Numbers (SSNs). Previously, this policy might trigger when a user visits a website that contains example SSNs in its content (the response body). Now, by setting the **Body Phase** to **Request Body**, the policy will only trigger if the user attempts to *upload* or *submit* a SSN, ignoring the content of the web page itself. + + +All policies without this selector will continue to scan both request and response bodies to ensure continued protection. + + +To learn more, please refer to our [Gateway policy selectors documentation](/cloudflare-one/policies/gateway/http-policies/#selectors/). From f90e98c7e2866eb745c2658ecacd02c42ab4de75 Mon Sep 17 00:00:00 2001 From: Max Phillips Date: Fri, 26 Sep 2025 16:29:33 -0500 Subject: [PATCH 2/4] Apply style guide --- .../dlp/2025-09-25-body-phase-selector.mdx | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx b/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx index 1d7d5adecec2b3d..6a12f1b8efb19de 100644 --- a/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx +++ b/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx @@ -6,18 +6,13 @@ date: 2025-09-25 You can now more precisely control your HTTP DLP policies by specifying whether to scan the request or response body, helping to reduce false positives and target specific data flows. +In the Gateway HTTP policy builder, you will find a new optional selector called _Body Phase_. This allows you to define the direction of traffic the DLP engine will inspect: -In the Gateway HTTP policy builder, you will find a new optional selector called **Body Phase**. This allows you to define the direction of traffic the DLP engine will inspect: - - -* **Request Body**: Scans data sent *from* a user's machine to an upstream service. This is ideal for monitoring data uploads, form submissions, or other user-initiated data exfiltration attempts. -* **Response Body**: Scans data sent *to* a user's machine from an upstream service. Use this to inspect file downloads and website content for sensitive data. - - -For example, consider a policy that blocks Social Security Numbers (SSNs). Previously, this policy might trigger when a user visits a website that contains example SSNs in its content (the response body). Now, by setting the **Body Phase** to **Request Body**, the policy will only trigger if the user attempts to *upload* or *submit* a SSN, ignoring the content of the web page itself. +- _Request Body_: Scans data sent from a user's machine to an upstream service. This is ideal for monitoring data uploads, form submissions, or other user-initiated data exfiltration attempts. +- _Response Body_: Scans data sent to a user's machine from an upstream service. Use this to inspect file downloads and website content for sensitive data. +For example, consider a policy that blocks Social Security Numbers (SSNs). Previously, this policy might trigger when a user visits a website that contains example SSNs in its content (the response body). Now, by setting the **Body Phase** to _Request Body_, the policy will only trigger if the user attempts to upload or submit an SSN, ignoring the content of the web page itself. All policies without this selector will continue to scan both request and response bodies to ensure continued protection. - -To learn more, please refer to our [Gateway policy selectors documentation](/cloudflare-one/policies/gateway/http-policies/#selectors/). +For more information, refer to [Gateway HTTP policy selectors](/cloudflare-one/policies/gateway/http-policies/#selectors/). From ae7d01d935b34f09206a31c88f3e79d0425a3db1 Mon Sep 17 00:00:00 2001 From: Max Phillips Date: Fri, 26 Sep 2025 16:41:52 -0500 Subject: [PATCH 3/4] Add product metadata --- src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx b/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx index 6a12f1b8efb19de..bbfb79826f6bfda 100644 --- a/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx +++ b/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx @@ -1,6 +1,9 @@ --- title: "Refine DLP Scans with New Body Phase Selector" description: Gain more control over your DLP detections and reduce false positives by specifying whether to scan the HTTP request or response body. +products: + - gateway + - data-loss-prevention date: 2025-09-25 --- From 4cad791bf78b026afb245b6b29c70fa568be133f Mon Sep 17 00:00:00 2001 From: Max Phillips Date: Fri, 26 Sep 2025 16:43:00 -0500 Subject: [PATCH 4/4] Fix products --- src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx b/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx index bbfb79826f6bfda..9122fef34d2011e 100644 --- a/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx +++ b/src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx @@ -3,7 +3,6 @@ title: "Refine DLP Scans with New Body Phase Selector" description: Gain more control over your DLP detections and reduce false positives by specifying whether to scan the HTTP request or response body. products: - gateway - - data-loss-prevention date: 2025-09-25 ---