cyber.hendryadrian.com
Security News · blog.cloudflare.com

Cloudflare opens beta of Application Profiles for web application security

· Original article ↗

Summary

Cloudflare is extending learned request-schema validation to web applications. Profiles flag requests that differ from observed structures; customers can review violations and create rules to block them. The feature is available to API Security customers and invited

Key points

  • Cloudflare says Application Profiles learn expected request structures from observed traffic and flag non-conforming requests.
  • Validation adds metadata to requests but does not block them by itself; customers can review results and create Security Rules to enforce blocking.
  • Profiles learn fields weekly. At least 1,000 successful requests in seven days are needed to learn fields, and 10,000 to learn data boundaries.
  • Cloudflare recommends reviewing profiles before enforcement because application changes, valid unusual requests, bots, or scanners can affect learned profiles.
  • API Security customers already have access; Cloudflare is offering a closed beta to invited Enterprise customers without API Security.
  • Current limitations include no support for multipart forms, GraphQL, or XML; profiles do not enforce required parameters or parameter uniqueness.

Article Details

Event Type
Cloudflare announced Application Profiles, a web-application positive security feature, and opened a closed beta to invited Enterprise customers without API Security.
Impact
Profiles learn expected request structures from observed traffic and flag non-conforming requests. Validation adds metadata but does not block requests by itself; customers can review results and configure Security Rules to enforce blocking. Cloudflare says this can help reduce attack surface by identifying unexpected values and formats. Customers with API Security already have access.

Vendors

Cloudflaresecurity policy. By analyzing the structure and format of HTTP requests and identifying deviations, Cloudflare can help you significantly reduce the attack surface area.

Products

API SecurityWe are opening a closed beta to invited Enterprise customers without API Security; customers with API Security already have access.Application ProfilesToday, we are launching Application Profiles, a seamless way to enforce a positive security policy. By analyzing the structure and format of HTTP requests and identifying deviations, Cloudflare can help you

Related Articles