Client is getting a managed challenge even though request is legitimate. Cannot tell why.

Original message was deleted

kian•1/4/24, 1:28 PM

Essentially off is, well, not quite off. Very bad scores will hit it

kian•1/4/24, 1:28 PM

https://developers.cloudflare.com/waf/tools/security-level/

Security Level · Cloudflare Web Application Firewall (WAF) docs

Cloudflare’s Security Level uses the threat score (IP reputation) to decide whether to present a challenge to the visitor. Once the visitor enters the …

kian•1/4/24, 1:30 PM

If the DNS record isn't proxied then nothing Cloudflare does will take effect since the traffic won't go through Cloudflare.

kian•1/4/24, 1:30 PM

Depends if the R2 team have a security level set on that zone.

kian•1/4/24, 1:32 PM

It's not an "are you a bot" check, it's if that IP is the source of abuse.

kian•1/4/24, 1:32 PM

The threat score measures IP reputation across Cloudflare services. This score is calculated based on Project Honeypot, external public IP information, as well as internal threat intelligence from our WAF managed rules and DDoS.

Kkian It's not an "are you a bot" check, it's if that IP is the source of abuse.

justjumper•1/5/24, 7:17 AM

How do you handle a challenge? Like when a user gets a cf-mitigated="challenge"cf-mitigated="challenge" header, what do you do? The Cloudflare docs don't cover this as far as I can tell.

Client is getting a managed challenge even though request is legitimate. Cannot tell why.

Similar Threads

Similar Threads

Similar Threads