Hi, just wanted to confirm if there is any ongoing issue with WAF custom rules? It appears to be blo

Hi, just wanted to confirm if there is any ongoing issue with WAF custom rules? It appears to be blocking valid requests intermittently

Aashutosh Hi, just wanted to confirm if there is any ongoing issue with WAF custom rules? ...

Chaika•12/27/23, 5:21 PM

Did you check Security -> Events to see the reason for the blocks?

Chaika•12/27/23, 5:22 PM

Magic Link: https://dash.cloudflare.com/?to=/:account/:zone/security/events

ashutoshOP•12/27/23, 5:25 PM

It just says that it's blocked by the same custom rule which is allowing requests otherwise.

Chaika•12/27/23, 5:26 PM

What's the Custom Rule Expression & the details of the request that got blocked (blurring anything sensitive)?

CChaika What's the Custom Rule Expression & the details of the request that got blocked ...

ashutoshOP•12/27/23, 5:35 PM

if (starts_with(http.request.uri.path, "/<initial_part_of_path>/") and not is_timed_hmac_valid_v0(<secret_key>, http.request.uri, <ttl>, http.request.timestamp.sec, <separator_length>)) then block else allow

CChaika What's the Custom Rule Expression & the details of the request that got blocked ...

ashutoshOP•12/27/23, 5:41 PM

Request: <public_domain_of_the_bucket>/<initial_part_of_path>/<rest_of_path_to_the_asset><separator><timestamp>-<generated_token>

Chaika•12/27/23, 5:46 PM

So sounds like it just wasn't valid. Was it already expired based on the ttl and timestamp, or something else perhaps?

CChaika So sounds like it just wasn't valid. Was it already expired based on the ttl and...

ashutoshOP•12/27/23, 5:50 PM

It hasn't expired. I generated another request, few minutes after the first one failed, using exactly same method and it worked for same asset. And again another request generated using exactly same method has failed. The ttl is not too short to have caused the issue.

Chaika•12/27/23, 6:08 PM

Interesting.. I would guess something else is wrong with the signature/mac then, or if you're letting clients generate the timestamp it could be off. I haven't used hmac myself much before, I can say normal custom rules look fine right now and update in less then a few seconds.

CChaika Interesting.. I would guess something else is wrong with the signature/mac then,...

ashutoshOP•12/27/23, 6:10 PM

Okay, let me try to debug more. Interesting thing is that it was working fine until few hours back, but then it suddenly started blocking requests without any change in the rule or code which generates the token.

Cyb3r-Jak3•12/27/23, 6:34 PM

Ticket is probably your best bet

Chaika•12/27/23, 6:37 PM

I don't recall issues like that with WARP but when I was using it for private networking stuff I used Split Tunnels and just included the private networking ranges/domains so the rest of my traffic wasn't tunneled. Might be a workaround depending on how you use it

SStupeFied i've tried turning off proxy, but i see the same issue as well

Chaika•12/27/23, 6:44 PM

yea all proxy would do is stop sending stuff to gateway iirc, it's still being sent over the VPN, unlike if you used split tunnels to exclude it entirely

shots.by.luke•12/28/23, 3:29 AM

mjchesley•12/28/23, 3:37 AM

cloudflare hates me...

mjchesley•12/28/23, 3:39 AM

Mmjchesley Click to see attachment

Cyb3r-Jak3•12/28/23, 3:58 AM

You need to open a billing ticket here: https://dash.cloudflare.com/?to=/:account/support

mjchesley•12/28/23, 3:59 AM

Thanks!

smyth•12/28/23, 7:16 AM

keval-mandalik•12/28/23, 9:17 AM

Hey Team,

I need guidance on below error screenshot attached

I have purchaded domain and subdomain on godaddy now I have pointed out that sub domain to cloudflare worker URL but it's giving error which I have attached appreciate your help

Thanks

Erisa•12/28/23, 9:33 AM

You CNAMEd to something that youre not allowed to CNAME to - in the case of a Worker, the only way to access those is over a Custom Domain or Worker Route with the domain on Cloudflare as either a zone or a Custom Hostname

EErisa You CNAMEd to something that youre not allowed to CNAME to - in the case of a Wo...

keval-mandalik•12/28/23, 10:12 AM

can u pls elaborate?

Erisa•12/28/23, 10:13 AM

On which part? I'd need to know more about your setup

Erisa•12/28/23, 10:13 AM

Is the domain using Cloudflare? Where did you point it?

keval-mandalik•12/28/23, 10:14 AM

subdomain i have purchased xyz.example.com I am pointing that xyz to my worker URL

Erisa•12/28/23, 10:16 AM

How did you point it? And is it using Cloudflare?

If you are just doing CNAME xyz.example.com thing.name.workers.devCNAME xyz.example.com thing.name.workers.dev then this will not work as you need to add a Custom Domain or Route to the Worker and the Worker needs to be on the same account that the domain is also active on, OR you need to create a Custom Hostname on the account with the Worker

Erisa•12/28/23, 10:17 AM

https://developers.cloudflare.com/workers/configuration/routing/custom-domains/
https://developers.cloudflare.com/workers/configuration/routing/routes/