Production Users Getting cf-mitigated header

Hi, some of our users are getting the

cf-mitigated = "challenge"

cf-mitigated = "challenge"

cf-mitigated = "challenge"

cf-mitigated = "challenge" header. My understanding is that they must complete a challenge to get the

cf_clearance

cf_clearance

cf_clearance

cf_clearance and then they can proceed. The problem is, it doesn't seem like there is any documentation on how to actually do this. The official docs (shown in the screenshot) don't go into any details on how to actually "handle" the challenge on the client.

https://developers.cloudflare.com/waf/reference/cloudflare-challenges/

Challenges · Cloudflare Web Application Firewall (WAF) docs

When a website is protected by Cloudflare, there are several occasions when it will challenge visitor traffic:

Erisa•1/5/24, 9:32 AM

Theres one example of how to do that with Turnstile on here https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests

The Cloudflare Blog

Integrating Turnstile with the Cloudflare WAF to challenge fetch re...

By editing or creating a new Turnstile widget with “Pre-Clearance” enabled, Cloudflare customers can now use Turnstile to issue a challenge when a page’s HTML loads, and enforce that all valid responses have a valid Turnstile token. They can then write a Cloudflare WAF rule to challenge all requests to their API. The Cloudflare WAF will check fo...

EErisa Theres one example of how to do that with Turnstile on here https://blog.cloudfl...

justjumperOP•1/6/24, 4:03 AM

Ahh thanks! How does this work with a separate domain though?

In our case, the site is www.<site>.com but the api is api.<site>.com

So the OPTIONS request fails before it even has the chance to send the

cf_clearance

cf_clearance

cookie. This issue is noted here: https://developers.cloudflare.com/waf/reference/cloudflare-challenges/#cross-origin-resource-sharing-cors-preflight-requests, though there is no solution provided.

Challenges · Cloudflare Web Application Firewall (WAF) docs

When a website is protected by Cloudflare, there are several occasions when it will challenge visitor traffic:

Jjustjumper Ahh thanks! How does this work with a separate domain though? In our case, the ...

Metriusz•1/6/24, 10:19 AM

For the CORS headers, you can set up a transform rule to modify those in the response

Production Users Getting cf-mitigated header

Similar Threads

Similar Threads

Similar Threads