yea sadly Spectrum for Pay as you go plans is more of a teaser/trial. You'd need to go Enterprise to

yea sadly Spectrum for Pay as you go plans is more of a teaser/trial. You'd need to go Enterprise to get custom pricing, and that's a few thousand/month min

CChaika yea sadly Spectrum for Pay as you go plans is more of a teaser/trial. You'd need...

Deliable•3/31/24, 1:16 AM

Yeah, that seems fair. Thanks!

Deliable•3/31/24, 1:18 AM

Also, does Magic Transit have a firewall option?

Deliable•3/31/24, 1:19 AM

For example, an usage case for it would be implementing a L7 protection using the capacity of Magic Transit since I think Magic Transit doesn't have L7 support for many apps

DDeliable Also, does Magic Transit have a firewall option?

ChaikaOP•3/31/24, 1:30 AM

I believe that's what the Magic Firewall is: https://developers.cloudflare.com/magic-firewall/
That's super Enterprise though, not stuff I've played around with

Cloudflare Docs

Magic Firewall · Cloudflare Magic Firewall docs

Magic Firewall is a firewall-as-a-service (FWaaS) delivered from the Cloudflare global network to protect office networks and cloud infrastructure …

CChaika I believe that's what the Magic Firewall is: https://developers.cloudflare.com/m...

Deliable•3/31/24, 1:31 AM

Yeah I know, just checking stuff haha

haters daddyhd from bulgaria•3/31/24, 3:55 AM

Hello

Nguyễn Khang•3/31/24, 4:08 AM

hello

Nguyễn Khang•3/31/24, 4:08 AM

I have a question can you help me?

Ggggrunt Can learn more about solutions, goal is possibly restrict access to the page, if...

Karew•3/31/24, 5:31 AM

You can
(1) Put your domain on Cloudflare, you probably already did (2) Set a CNAME record to your Digital Ocean app, or whatever instructions for domains they provide (3) Use a Cloudflare WAF rule to show a block page to anyone who visits that subdomain that doesn't match rules you set, like IP address or having some kind of secret token in the link.

Karew•3/31/24, 5:31 AM

This isn't 100% strict security, so don't do this if your preview app is like, critically secret

RRapid So, DarkDeviL suggested we increase the TTL on that which is currently 10mins, d...

DarkDeviL•3/31/24, 7:07 AM

I may not have made that message crystal clear enough: My suggestion was NOT meant to indicate that you should just blindly raise the TTL, if that was how it was understood.

Some use-cases (e.g. slowly / almost never changing data) can typically be cached for a (very) long time, in which case it would typically make absolutely no sense, to keep it alone on 600 seconds / 10 minutes. How far you could eventually go, would be depending on various different criteria though.

Looking at your elaboration later on, it does actually sound like it would justify for a long(er) TTL than the 600 seconds / 10 minutes. Maybe even longer than the 3600 seconds / 1 hour, that you indicated you raised it to.

Kasumi•3/31/24, 4:19 PM

I ignored it tbh. Someone thought if it works, don't touch it

DDarkDeviL I may not have made that message crystal clear enough: My suggestion was **NOT**...

Rapid•3/31/24, 4:40 PM

Thanks! Yeah, I'm gona do some tests and check more best practices when it comes to it in cloudflare. Traffic has a huge impact on it

German•3/31/24, 7:34 PM

Anyone know how in zero trust i can have a policy for a domain, but with exclusions for certain paths that would be accessible to everyone?

GGerman Anyone know how in zero trust i can have a policy for a domain, but with exclusi...

Erisa•3/31/24, 7:44 PM

You can create a new policy with the paths, action of Bypass and selector of Everyone

dave•3/31/24, 9:49 PM

Is it possible to calculate a AWS-HMAC-SHA256 signature using a WAF rule?

https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html#create-signature-presign-entire-payload

Signature Calculations for the Authorization Header: Transferring P...

Authenticate requests using the HTTP authorization header to compute a checksum for smaller payloads.

D5•3/31/24, 10:16 PM

How I can report a typo/bad translation in Cloudflare translations?

D5•3/31/24, 10:17 PM

The new WAF challenge window translation says in my lang something like "Verification you're a human" instead of "Verifying you're a human" (that is the current phrase in english)

D5•3/31/24, 10:20 PM

So it fells weird

DD5 The new WAF challenge window translation says in my lang something like "Verific...

Erisa•3/31/24, 10:30 PM

Could you share which language, and what the current & expected translations are? I can pass it along

dave•3/31/24, 11:59 PM

why does the

http.request.uri.args["ttl"][0]

http.request.uri.args["ttl"][0]

not work?

(http.host eq "example.com" and not is_timed_hmac_valid_v0("removed", http.request.uri, http.request.uri.args["ttl"][0], http.request.timestamp.sec, 8))

(http.host eq "example.com" and not is_timed_hmac_valid_v0("removed", http.request.uri, http.request.uri.args["ttl"][0], http.request.timestamp.sec, 8))

Ddave Is it possible to calculate a AWS-HMAC-SHA256 signature using a WAF rule? https...

Karew•4/1/24, 1:30 AM

I don’t think so, the WAF doesn’t have access to your R2 tokens

KKarew I don’t think so, the WAF doesn’t have access to your R2 tokens

dave•4/1/24, 1:31 AM

all good, I ended up just doing a regular HMAC rule.

chientrm.com•4/1/24, 2:41 AM

ohm, I can't

Add domain

Add domain

more in my Access -> Applications

Tony Leung•4/1/24, 3:36 AM

hi guys, is there anyway to add

CORP

CORP

header to

.cloudflareaccess.com

.cloudflareaccess.com

preflight response?

EErisa Could you share which language, and what the current & expected translations are...

D5•4/1/24, 5:06 AM

Spanish.

Current translation:
Verificar que usted es un ser humano

Expected:
Verificando que usted es un ser humano

DD5 Spanish. Current translation: Verificar que usted es un ser humano Expected: ...

Erisa•4/1/24, 7:50 AM

Thanks!

DD5 Spanish. Current translation: Verificar que usted es un ser humano Expected: ...

Erisa•4/1/24, 8:32 AM

I passed this to the challenges team and they will fix the translation, thanks for your help

chientrm.com•4/1/24, 10:14 AM

It doesn't work

Cchientrm.com It doesn't work

Erisa•4/1/24, 11:50 AM

do you have a proxied DNS record?

Oom When are posts releasing? What time

Hello, I’m Allie!•4/1/24, 12:20 PM

Probably https://discord.com/channels/595317990191398933/1224053373532110949/1224281182666227722

dave•4/1/24, 1:07 PM

Do modified response headers resulting from a transform rule get cached?

Tony Leung•4/1/24, 2:21 PM

hi guys, how can I add CORP header to

.cloudflareaccess.com

.cloudflareaccess.com

response? My page is serving some assets from R2 custom domain and both of them are guarded by CF Access. Normally when I logged into my page (via zero trust) then content from R2 custom domain will automatically be authorized too. But now since my page has some requirements which needs COEP header to be

require-corp

require-corp

, I cant automatically authorize access to R2 domain anymore but manually going to that R2 domain then verify because the

.cloudflareaccess.com

.cloudflareaccess.com

domain does not contain CORP header

Tony Leung•4/1/24, 2:23 PM

this problem used to happen with turnstile but it was fix a while ago

dave•4/1/24, 2:23 PM

@Chaika r2

Do you think I could turn this into a redirect rule instead of a Worker?

I wish there was a way to use

cf.colo.region

cf.colo.region

.. that would make life so much easier.

Tony Leung•4/1/24, 2:24 PM

it's really inconvenient to force users to goto R2 custom domain.

Ddave @Chaika https://discord.com/channels/595317990191398933/940663374377783388/12229...

ChaikaOP•4/1/24, 2:25 PM

lol yea it'd be nice. We don't even have colo name in ruleset engine atm

CChaika lol yea it'd be nice. We don't even have colo name in ruleset engine atm

dave•4/1/24, 2:25 PM

we actually do have

cf.colo.id

cf.colo.id

it seems

ChaikaOP•4/1/24, 2:25 PM

yea but not name

ChaikaOP•4/1/24, 2:25 PM

id is just the numerical number assigned, not the iata airport code

ChaikaOP•4/1/24, 2:26 PM

you could potentially make an auto updating redirect rule using that though

CChaika yea but not name

dave•4/1/24, 2:26 PM

I couldn't figure it out, but couldn't we use lookup_json_string to convert the id to a name?

Ddave I couldn't figure it out, but couldn't we use lookup_json_string to convert the ...

ChaikaOP•4/1/24, 2:27 PM

what would you be looking up off?

ChaikaOP•4/1/24, 2:27 PM

like hardcoding the entire json list of colos, and then looking up for region?

CChaika like hardcoding the entire json list of colos, and then looking up for region?

dave•4/1/24, 2:27 PM

yes

CChaika id is just the numerical number assigned, not the iata airport code

dave•4/1/24, 2:27 PM

hmm, doesn't

substring(cf.ray_id, 17)

substring(cf.ray_id, 17)

get you most of the way there?

dave•4/1/24, 2:28 PM

I get

MIA

MIA

for my location.

yea sadly Spectrum for Pay as you go plans is more of a teaser/trial. You'd need to go Enterprise to

Similar Threads

Similar Threads

Similar Threads