Cloudflare Adds Full-Transaction Detection and Response Rules to WAF
Summary
Cloudflare says its WAF can now correlate HTTP requests with origin responses to detect possible exploit success, then block matching responses before they reach requesters. The capabilities are generally available across plans.
Key points
- Full-transaction detections assess requests alongside the corresponding origin responses to identify evidence that an exploit may have succeeded.
- Response rules can replace a matching origin response with a WAF block page or custom response before it reaches the requester; they cannot undo actions already performed at the origin.
- Cloudflare says its initial managed protections use this capability for the recently disclosed php2shell vulnerability.
- Customers can combine request and response properties in custom rules; all plans can create up to three response rules with Log and Block actions.
- Response-body rules are not yet available, and Cloudflare says response detection fields are still rolling out to accounts.
- Matching events are available in Security Events for investigation, with request and response rule events shown in the same analytics page.
Article Details
- Event Type
- Cloudflare made full transaction detections and response rules generally available to all customers, including Free plans.
- Impact
- Cloudflare WAF can correlate HTTP requests with origin responses to identify evidence that an exploit may have succeeded, then block a matching response before it reaches the requester. This can help prevent sensitive information from being exposed and reduce false positives compared with request-only detection. Response rules cannot undo actions already performed at the origin.