跳转到主要内容

章节Cloudflare 开发者文档（免费档）

Waf

167 页更新于 1 天前

开始阅读

本章内容167

  1. 01 Concepts import { GlossaryTooltip, Render, DashButton } from "~/components"; :::note[What is a Web Application Firew... 1 天前
  2. 02 Security features interoperability import { Details, Steps, DashButton, GlossaryTooltip } from "~/components"; Cloudflare applies multiple sec... 1 天前
  3. 03 Get started import { Stream, Details, GlossaryTooltip, Steps, DashButton, Render, } from "~/components"; The Cloudflare... 1 天前
  4. 04 Glossary import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's WAF docum... 1 天前
  5. 05 Cloudflare Web Application Firewall import { Description, Feature, Plan, RelatedProduct, Render, Stream, } from "~/components"; Get automatic p... 1 天前
  6. 06 Account-level WAF configuration The account-level Web Application Firewall (WAF) configuration allows you to define a configuration once an... 1 天前
  7. 07 Create a custom ruleset using the API import { Render, APIRequest } from "~/components"; :::note This feature requires an Enterprise plan. ::: Qu... 1 天前
  8. 08 Work with custom rulesets in the dashboard import { Render, Steps, DashButton } from "~/components"; :::note[Notes] Custom rulesets at the account lev... 1 天前
  9. 09 Custom rulesets (account level) Custom rulesets are collections of custom rules that you can deploy at the account or zone level. Like cust... 1 天前
  10. 10 Deploy a WAF managed ruleset via API (account) import { Render } from "~/components"; :::note This feature requires an Enterprise plan. ::: Use the Rulese... 1 天前
  11. 11 Deploy a WAF managed ruleset in the dashboard (account) import { Render, Steps, DashButton } from "~/components"; :::note This feature requires an Enterprise plan.... 1 天前
  12. 12 Managed rulesets import { Render, Tabs, TabItem, Details, APIRequest } from "~/components"; Account-level deployment At the ... 1 天前
  13. 13 Create a rate limiting ruleset via API import { Render, APIRequest } from "~/components"; To deploy rate limiting rules at the account level, you ... 1 天前
  14. 14 Create a rate limiting ruleset in the dashboard import { Render, Steps, DashButton } from "~/components"; :::note This feature requires an Enterprise plan.... 1 天前
  15. 15 Rate limiting rulesets import { GlossaryTooltip } from "~/components"; Rate limiting rules allow you to define a rate limit for re... 1 天前
  16. 16 Analytics import { DirectoryListing } from "~/components"; Refer to the following pages for more information on the a... 1 天前
  17. 17 Security Analytics import { GlossaryTooltip, Badge, Steps, DashButton, Render, } from "~/components"; Security Analytics displ... 1 天前
  18. 18 Security Events import { GlossaryTooltip, Render, Steps, DashButton, } from "~/components"; Security Events allows you to r... 1 天前
  19. 19 Historical (2022) Ruleset Rule ID Legacy Rule ID Description Change Date Old Action New Action ... 1 天前
  20. 20 Historical (2023) Ruleset Rule ID Legacy Rule ID Description Change Date Old Action New Action ... 1 天前
  21. 21 Historical (2024) import { RuleID } from "~/components"; Managed ruleset updates General updates Managed ruleset updates ... 1 天前
  22. 22 WAF changelog overview import { LinkButton, RSSButton } from "~/components"; The WAF changelog provides information about changes ... 1 天前
  23. 23 Scheduled changes import { ProductChangelog } from "~/components"; For other WAF updates, refer to the changelog. 1 天前
  24. 24 Create a custom rule via API import { GlossaryTooltip, Render, APIRequest } from "~/components"; Use the Rulesets API to create a custom... 1 天前
  25. 25 Create a custom rule in the dashboard import { Render, Steps, DashButton } from "~/components"; In the Cloudflare dashboard, go to the Security r... 1 天前
  26. 26 Custom rulesets (zone level) import { Render, APIRequest, DashButton, Steps } from "~/components"; Custom rulesets are collections of cu... 1 天前
  27. 27 Custom rules import { Render } from "~/components"; Custom rules are evaluated in order, and some actions like Block wil... 1 天前
  28. 28 API examples import { APIRequest } from "~/components"; Use the Rulesets API to configure custom rules via API. The ski... 1 天前
  29. 29 Configure a rule with the Skip action import { TabItem, Tabs, Steps, DashButton } from "~/components"; Use the Skip action in a custom rule to sk... 1 天前
  30. 30 Available skip options The following sections cover the available skip options in custom rules. Skip the remaining custom rules (c... 1 天前
  31. 31 Allow traffic from IP addresses in allowlist only import { Steps } from "~/components"; This example blocks incoming requests from IP addresses that are not ... 1 天前
  32. 32 Allow traffic from specific countries only This example custom rule blocks requests based on country code using the ip.src.country field, only allowi... 1 天前
  33. 33 Allow traffic from search engine bots This example custom rule challenges requests from a list of countries, but allows traffic from search engin... 1 天前
  34. 34 Block requests by attack score import { GlossaryDefinition } from "~/components"; The attack score helps identify variations of known atta... 1 天前
  35. 35 Block traffic by geographical location This example custom rule blocks requests by autonomous system number (ASN), continent, or country of origin... 1 天前
  36. 36 Block Microsoft Exchange Autodiscover requests In some cases, Microsoft Exchange Autodiscover service requests can be "noisy", triggering large numbers of... 1 天前
  37. 37 Block Tor traffic Cloudflare identifies requests coming from Tor exit nodes with the continent code T1. If you do not want T... 1 天前
  38. 38 Block traffic from specific countries This example custom rule blocks requests based on country code using the ip.src.country field. When incomi... 1 天前
  39. 39 Block Worker subrequests from other zones The cf.worker.upstream_zone field identifies the zone that spawned a Workers subrequest. You can use this ... 1 天前
  40. 40 Challenge bad bots import { Render } from "~/components"; Cloudflare's Bot Management feature scores the likelihood that a req... 1 天前
  41. 41 Issue challenge for admin user in JWT claim based on attack score :::note To use claims inside a JSON Web Token (JWT), you must first set up a token validation configuration... 1 天前
  42. 42 Configure token authentication import { TabItem, Tabs, Example } from "~/components"; Token authentication allows you to restrict access t... 1 天前
  43. 43 Exempt partners from Hotlink Protection When enabled, Cloudflare Hotlink Protection blocks all HTTP referrers that are not part of your domain or z... 1 天前
  44. 44 Common use cases import { DirectoryListing } from "~/components"; The following common use cases illustrate how to secure we... 1 天前
  45. 45 Require a specific cookie To secure a sensitive area such as a development area, you can share a cookie with trusted individuals and ... 1 天前
  46. 46 Require specific HTTP headers Many organizations qualify traffic based on the presence of specific HTTP request headers. Use the Rules la... 1 天前
  47. 47 Require specific HTTP ports import { Render } from "~/components"; By default, Cloudflare allows requests on a number of different HTTP... 1 天前
  48. 48 Build a sequence rule within custom rules import { Render } from "~/components"; You can build an API sequence rule via the Cloudflare dashboard. 1 天前
  49. 49 Require known IP addresses in site admin area If an attack compromises the administrative area of your website, the consequences can be severe. With cust... 1 天前
  50. 50 Stop R-U-Dead-Yet? (R.U.D.Y.) attacks R-U-Dead-Yet (R.U.D.Y.) attacks accomplish denial of service (DoS) by submitting long form fields. Use cust... 1 天前
  51. 51 Update custom rules for customers or partners You may want to adjust your custom rules to increase access by customers or partners. Potential examples in... 1 天前
  52. 52 WAF attack score import { Type } from "~/components"; The attack score traffic detection classifies each request using a mac... 1 天前
  53. 53 Traffic detections import { DirectoryListing, Steps, DashButton } from "~/components"; Traffic detections check incoming reque... 1 天前
  54. 54 Example mitigation rules A customer support chatbot should not engage with prompts about violence or hate speech. This custom rule b... 1 天前
  55. 55 AI Security for Apps fields import { Type } from "~/components"; When enabled, AI Security for Apps populates the following fields: Fie... 1 天前
  56. 56 Get started with AI Security for Apps import { Tabs, TabItem, Details, Steps, DashButton, Render, } from "~/components"; 1. Turn on AI Security f... 1 天前
  57. 57 AI Security for Apps import { GlossaryTooltip } from "~/components"; Applications that use large language models (LLMs) are expo... 1 天前
  58. 58 Log mode versus production mode import { Steps, Tabs, TabItem, DashButton, APIRequest, RuleID, } from "~/components"; AI Security for Apps ... 1 天前
  59. 59 PII detection import { Details } from "~/components"; AI Security for Apps (formerly Firewall for AI) can detect personal... 1 天前
  60. 60 Prompt injection detection import { GlossaryTooltip, Details } from "~/components"; AI Security for Apps (formerly Firewall for AI) de... 1 天前
  61. 61 Token counting AI Security for Apps (formerly Firewall for AI) provides an estimated token count for each incoming LLM pro... 1 天前
  62. 62 Unsafe and custom topic detection import { Tabs, TabItem, Details, Steps, DashButton, GlossaryTooltip, } from "~/components"; AI Security for... 1 天前
  63. 63 Analyze profile detections import { DashButton, Steps } from "~/components"; Use Profile Analysis in Security Analytics to investigate... 1 天前
  64. 64 Enforce profiles with Custom Rules Application Profiles separate detection from mitigation. Cloudflare runs an always-on detection after a pro... 1 天前
  65. 65 Fields import { Details, Type } from "~/components"; Schema Profile detections populate these fields after an appl... 1 天前
  66. 66 Get started import { DashButton, Steps } from "~/components"; Create a learned Schema Profile for one operation. Then r... 1 天前
  67. 67 Application Profiles import { DirectoryListing } from "~/components"; Application Profiles define application-specific expectati... 1 天前
  68. 68 Schema Profiles A Schema Profile models expected request fields and their constraints. You can learn one from traffic or su... 1 天前
  69. 69 Analyze attack signatures import { DashButton, Steps } from "~/components"; Use Security Analytics > Attack Analysis to investigate a... 1 天前
  70. 70 Fields import { Type } from "~/components"; Attack Signature Detection populates these request fields when signatu... 1 天前
  71. 71 Attack Signature Detection import { DirectoryListing } from "~/components"; Attack Signature Detection evaluates requests against Clou... 1 天前
  72. 72 Use attack signatures in Security Rules import { Steps } from "~/components"; Attack Signature Detection fields let Security Rules act on matching ... 1 天前
  73. 73 Common API calls import { APIRequest } from "~/components"; The following examples address common scenarios of using the Clo... 1 天前
  74. 74 Example mitigation rules import { Example } from "~/components"; Rate limit suspicious logins with leaked credentials :::note Access... 1 天前
  75. 75 Get started import { Render, TabItem, Tabs, Details, Steps, GlossaryTooltip, APIRequest, DashButton, } from "~/componen... 1 天前
  76. 76 Leaked credentials detection import { Type } from "~/components"; The leaked credentials traffic detection scans incoming requests for c... 1 天前
  77. 77 Terraform configuration examples import { Details, Render, Tabs, TabItem } from "~/components"; The following Terraform configuration exampl... 1 天前
  78. 78 Common API calls import { APIRequest } from "~/components"; The following examples address common scenarios of using the Clo... 1 天前
  79. 79 Example rules This custom rule example logs all requests with at least one uploaded content object: When incoming request... 1 天前
  80. 80 Get started import { Details, TabItem, Tabs, Render, Steps, APIRequest, DashButton, } from "~/components"; :::note WAF ... 1 天前
  81. 81 Malicious uploads detection import { GlossaryTooltip, Type, Render } from "~/components"; The malicious uploads detection is a traffic ... 1 天前
  82. 82 Terraform configuration examples import { Details, GlossaryTooltip, Render, Tabs, TabItem } from "~/components"; The following Terraform con... 1 天前
  83. 83 Example rules Custom rule and rate limiting rule examples using threat intelligence fields. All fields are arrays — use ... 1 天前
  84. 84 Threat intelligence fields import { Type } from "~/components"; The threat intelligence detection populates the following fields when ... 1 天前
  85. 85 Get started import { Tabs, TabItem, Steps, DashButton } from "~/components"; Before you begin Your account must have an... 1 天前
  86. 86 Threat intelligence The threat intelligence detection matches incoming requests against indicators in the Cloudforce One threat... 1 天前
  87. 87 Deploy a WAF managed ruleset via API (zone) import { Render } from "~/components"; Use the Rulesets API to deploy a managed ruleset at the zone level. ... 1 天前
  88. 88 Deploy a WAF managed ruleset in the dashboard import { Render, Steps, DashButton } from "~/components"; The instructions in this page provide general gui... 1 天前
  89. 89 Managed Rules import { Render, RuleID } from "~/components"; Attack Signature Detection uses the same signatures as Cloud... 1 天前
  90. 90 Troubleshoot managed rules import { RuleID } from "~/components"; By default, WAF's managed rulesets are compatible with most websites... 1 天前
  91. 91 Configure exposed credentials checks via API import { Render, APIRequest } from "~/components"; Configure exposed credentials checks using the Rulesets ... 1 天前
  92. 92 Configure exposed credentials checks using Terraform import { Render } from "~/components"; The following Terraform configuration example addresses a common use... 1 天前
  93. 93 How exposed credentials checks work import { Render, Example } from "~/components"; WAF rules can include a check for exposed credentials. When... 1 天前
  94. 94 Check for exposed credentials import { GlossaryTooltip, Render } from "~/components"; Many web applications have suffered credential stuf... 1 天前
  95. 95 Monitor exposed credentials events import { Render } from "~/components"; Sampled logs in Security Events shows entries for requests with expo... 1 天前
  96. 96 Test your exposed credentials checks configuration import { Render } from "~/components"; After enabling and configuring exposed credentials checks, you may w... 1 天前
  97. 97 Upgrade to leaked credentials detection import { Render, Steps, DashButton } from "~/components"; This guide describes the general steps to upgrade... 1 天前
  98. 98 Configure payload logging via API import { RuleID, APIRequest } from "~/components"; Use the Rulesets API to configure payload logging for a ... 1 天前
  99. 99 Configure payload logging in the dashboard import { Steps, DashButton } from "~/components"; :::note Only users with the Super Administrator role can ... 1 天前
  100. 100 Store decrypted matched payloads in logs import { GlossaryTooltip, RuleID } from "~/components"; You can include the encrypted matched payload in yo... 1 天前
  101. 101 Log the payload of matched rules import { GlossaryTooltip } from "~/components"; The WAF allows you to log the request information that trig... 1 天前
  102. 102 View the payload content in the dashboard import { Steps, DashButton } from "~/components"; View the content of the matched rule payload in the dashb... 1 天前
  103. 103 Decrypt the payload content import { Steps } from "~/components"; Use the matched-data-cli tool to decrypt a payload in the command li... 1 天前
  104. 104 Generate a key pair import { Steps } from "~/components"; Generate a public/private key pair using the Cloudflare matched-data... 1 天前
  105. 105 Command-line operations import { DirectoryListing } from "~/components"; The Cloudflare matched-data-cli command-line tool support... 1 天前
  106. 106 Cloudflare Managed Ruleset import { Details, Markdown, Render, Tabs, TabItem, Steps, DashButton, } from " /components"; import { Image... 1 天前
  107. 107 Cloudflare Exposed Credentials Check Managed Ruleset import { Render, RuleID, APIRequest } from "~/components"; The Cloudflare Exposed Credentials Check Managed... 1 天前
  108. 108 Rulesets reference import { DirectoryListing } from "~/components"; 1 天前
  109. 109 Cloudflare Sensitive Data Detection import { Render, RuleID, APIRequest, Steps, DashButton } from " /components"; import { Image } from "astro:... 1 天前
  110. 110 Concepts The paranoia level (PL) classifies OWASP rules according to their aggressiveness. Paranoia levels vary from... 1 天前
  111. 111 Configure via API import { Details, RuleID, APIRequest } from "~/components"; To enable the Cloudflare OWASP Core Ruleset for... 1 天前
  112. 112 Configure in the dashboard import { Render, Markdown, Steps, DashButton } from " /components"; import { Image } from "astro:assets"; i... 1 天前
  113. 113 OWASP evaluation example import { RuleID } from "~/components"; The following example calculates the OWASP request threat score for ... 1 天前
  114. 114 Cloudflare OWASP Core Ruleset import { DirectoryListing, Render } from "~/components"; export const owaspCrsVersion = "3.3.0"; The Cloudf... 1 天前
  115. 115 Add an exception via API import { RuleID, APIRequest } from "~/components"; To add a managed rules exception using the API, create a... 1 天前
  116. 116 Add an exception in the dashboard import { Steps, DashButton } from "~/components"; 1. Go to the zone or account dashboard page To add an exc... 1 天前
  117. 117 Create exceptions Create an exception to skip the execution of WAF managed rulesets or some of their rules. The exception con... 1 天前
  118. 118 Rate limiting best practices import { Render } from "~/components"; The following sections cover typical rate limiting configurations fo... 1 天前
  119. 119 Create a rate limiting rule via API import { Render, APIRequest } from "~/components"; Use the Rulesets API to create a rate limiting rule via ... 1 天前
  120. 120 Create a rate limiting rule in the dashboard import { Render, Steps, DashButton } from "~/components"; In the Cloudflare dashboard, go to the Security r... 1 天前
  121. 121 Find appropriate rate limit import { Steps, DashButton } from "~/components"; The Request rate analysis tab in Security Analytics displ... 1 天前
  122. 122 Rate limiting rules import { Render } from "~/components"; Rate limiting rules allow you to define rate limits for requests mat... 1 天前
  123. 123 Rate limiting parameters import { Type } from "~/components"; The available rate limiting rule parameters are described in the follo... 1 天前
  124. 124 Request rate calculation import { Example, GlossaryTooltip } from "~/components"; Cloudflare tracks request rates by maintaining sep... 1 天前
  125. 125 Troubleshoot rate limiting rules Cloudflare may count Workers subrequests on the same zone as separate requests, which will cause a rate lim... 1 天前
  126. 126 Rate limiting rule examples import { Example } from "~/components"; The examples below include sample rate limiting rule configurations... 1 天前
  127. 127 Alerts for security events import { AvailableNotifications } from "~/components"; Cloudflare provides two types of security alerts tha... 1 天前
  128. 128 Reference import { DirectoryListing } from "~/components"; 1 天前
  129. 129 WAF phases import { DashButton } from "~/components"; The Web Application Firewall provides the following phases where... 1 天前
  130. 130 Firewall rules upgrade Cloudflare upgraded existing firewall rules into custom rules. With custom rules, you get the same level of... 1 天前
  131. 131 Legacy features import { DirectoryListing } from "~/components"; Refer to the following pages for more information on legac... 1 天前
  132. 132 Rate Limiting (previous version) import { DashButton } from "~/components"; Cloudflare Rate Limiting automatically identifies and mitigates ... 1 天前
  133. 133 Troubleshoot Rate Limiting (previous version) A few common rate limiting configuration issues prevent proper request matches: Including HTTP or HTTPS pro... 1 天前
  134. 134 Rate limiting (previous version) upgrade Cloudflare has upgraded all rate limiting rules created in the previous version to the new version of rate ... 1 天前
  135. 135 WAF managed rules (previous version) Managed rules, a feature of Cloudflare WAF (Web Application Firewall), identifies and removes suspicious ac... 1 天前
  136. 136 Troubleshoot WAF managed rules (previous version) By default, WAF managed rules are fully managed via the Cloudflare dashboard and are compatible with most w... 1 天前
  137. 137 WAF managed rules upgrade import { GlossaryTooltip, DashButton } from "~/components"; On 2022-05-04, Cloudflare started the upgrade f... 1 天前
  138. 138 Browser Integrity Check import { Render, Steps, DashButton } from "~/components"; Browser Integrity Check is enabled by default. Di... 1 天前
  139. 139 Additional tools import { DirectoryListing } from "~/components"; The Cloudflare WAF offers the following additional tools: 1 天前
  140. 140 Privacy Pass Privacy Pass specifies an extensible protocol for creating and redeeming anonymous and transferable tokens.... 1 天前
  141. 141 Replace insecure JS libraries import { GlossaryTooltip, Tabs, TabItem, Steps, APIRequest, DashButton, } from "~/components"; This feature... 1 天前
  142. 142 Security Level In the old Cloudflare dashboard, security level has the value Always protected and you cannot change this s... 1 天前
  143. 143 User Agent Blocking import { TabItem, Tabs, Steps, APIRequest, DashButton, } from "~/components"; User Agent Blocking allows yo... 1 天前
  144. 144 Validation checks import { GlossaryTooltip } from "~/components"; Cloudflare performs a validation check for every request. T... 1 天前
  145. 145 Zone Lockdown import { TabItem, Tabs, Steps, APIRequest, DashButton, } from "~/components"; Zone Lockdown specifies a lis... 1 天前
  146. 146 IP Access rules actions An IP Access rule can perform one of the following actions: Block: Prevents a visitor from visiting your si... 1 天前
  147. 147 Create an IP access rule import { TabItem, Tabs, Steps, DashButton } from "~/components"; :::tip[Recommendation: Use custom rules in... 1 天前
  148. 148 IP Access rules import { GlossaryTooltip } from "~/components"; Use IP Access rules to allowlist, block, and challenge traf... 1 天前
  149. 149 IP Access rules parameters An IP Access rule will apply a certain action to incoming traffic based on the visitor's IP address, IP ran... 1 天前
  150. 150 Create a list in the dashboard import { Render, Steps, DashButton } from "~/components"; To create a list, follow these steps: In the Clou... 1 天前
  151. 151 Custom lists import { Details } from "~/components"; A custom list contains one or more items of the same type (for exam... 1 天前
  152. 152 Lists import { Render, GlossaryTooltip } from "~/components"; Lists allow you to group items such as IP addresses... 1 天前
  153. 153 Managed Lists import { Render } from "~/components"; Cloudflare provides Managed Lists you can use in rule expressions. T... 1 天前
  154. 154 Use lists in expressions import { Render, Steps } from "~/components"; Use a list in the Expression Builder To use a list in the Exp... 1 天前
  155. 155 Lists API endpoints To invoke a Lists API operation, append the endpoint to the Cloudflare API base URL: https://api.cloudflare... 1 天前
  156. 156 Lists API The Lists API provides an interface for programmatically managing the following types of lists: Custom list... 1 天前
  157. 157 List JSON object import { Type } from "~/components"; List object structure and properties A JSON response for the Lists API... 1 天前
  158. 158 Email Address Obfuscation import { Render, TabItem, Tabs, Steps, DashButton } from "~/components"; By enabling Cloudflare Email Addre... 1 天前
  159. 159 Hotlink Protection import { Render, TabItem, Tabs, Steps, DashButton } from "~/components"; Hotlink Protection prevents your i... 1 天前
  160. 160 Scrape Shield import { DirectoryListing } from "~/components"; Scrape Shield is a collection of settings meant to protect... 1 天前
  161. 161 Bing's Site Scan blocked by a managed rule import { RuleID } from "~/components"; Microsoft Bing Webmaster Tools provides a Site Scan feature that cra... 1 天前
  162. 162 Issues sharing to Facebook import { GlossaryTooltip } from "~/components"; Cloudflare does not block or challenge requests from Facebo... 1 天前
  163. 163 Fake bot detection blocking legitimate requests import { RuleID } from "~/components"; The Cloudflare Managed Ruleset includes rules that detect requests i... 1 天前
  164. 164 FAQ Why does a security event display a Cloudflare IP address even though other fields match the client details... 1 天前
  165. 165 Troubleshooting import { DirectoryListing } from "~/components"; 1 天前
  166. 166 Rule phase interactions Cloudflare evaluates request processing features in phases. A rule that appears correct in isolation can be... 1 天前
  167. 167 SameSite cookie interaction with Cloudflare import { GlossaryTooltip } from "~/components"; Google Chrome enforces SameSite cookie behavior to protect ... 1 天前