Also, does Magic Transit have a firewall option?
Also, does Magic Transit have a firewall option?
DFor example, an usage case for it would be implementing a L7 protection using the capacity of Magic Transit since I think Magic Transit doesn't have L7 support for many apps
CI believe that's what the Magic Firewall is: https://developers.cloudflare.com/magic-firewall/
That's super Enterprise though, not stuff I've played around with
That's super Enterprise though, not stuff I've played around with
Cloudflare Docs
Magic Firewall is a firewall-as-a-service (FWaaS) delivered from the Cloudflare global network to protect office networks and cloud infrastructure …
DYeah I know, just checking stuff haha
HHello
Nhello
NI have a question can you help me?
KYou can
(1) Put your domain on Cloudflare, you probably already did (2) Set a CNAME record to your Digital Ocean app, or whatever instructions for domains they provide (3) Use a Cloudflare WAF rule to show a block page to anyone who visits that subdomain that doesn't match rules you set, like IP address or having some kind of secret token in the link.
(1) Put your domain on Cloudflare, you probably already did (2) Set a CNAME record to your Digital Ocean app, or whatever instructions for domains they provide (3) Use a Cloudflare WAF rule to show a block page to anyone who visits that subdomain that doesn't match rules you set, like IP address or having some kind of secret token in the link.
KThis isn't 100% strict security, so don't do this if your preview app is like, critically secret
DI may not have made that message crystal clear enough: My suggestion was NOT meant to indicate that you should just blindly raise the TTL, if that was how it was understood. 
Some use-cases (e.g. slowly / almost never changing data) can typically be cached for a (very) long time, in which case it would typically make absolutely no sense, to keep it alone on 600 seconds / 10 minutes. How far you could eventually go, would be depending on various different criteria though.
Looking at your elaboration later on, it does actually sound like it would justify for a long(er) TTL than the 600 seconds / 10 minutes. Maybe even longer than the 3600 seconds / 1 hour, that you indicated you raised it to.
Some use-cases (e.g. slowly / almost never changing data) can typically be cached for a (very) long time, in which case it would typically make absolutely no sense, to keep it alone on 600 seconds / 10 minutes. How far you could eventually go, would be depending on various different criteria though.
Looking at your elaboration later on, it does actually sound like it would justify for a long(er) TTL than the 600 seconds / 10 minutes. Maybe even longer than the 3600 seconds / 1 hour, that you indicated you raised it to.
KI ignored it tbh. Someone thought if it works, don't touch it
RThanks! Yeah, I'm gona do some tests and check more best practices when it comes to it in cloudflare. Traffic has a huge impact on it
GAnyone know how in zero trust i can have a policy for a domain, but with exclusions for certain paths that would be accessible to everyone?
EYou can create a new policy with the paths, action of Bypass and selector of Everyone
DIs it possible to calculate a AWS-HMAC-SHA256 signature using a WAF rule?
https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html#create-signature-presign-entire-payload
https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html#create-signature-presign-entire-payload
Authenticate requests using the HTTP authorization header to compute a checksum for smaller payloads.
DHow I can report a typo/bad translation in Cloudflare translations?
DThe new WAF challenge window translation says in my lang something like "Verification you're a human" instead of "Verifying you're a human" (that is the current phrase in english)
DSo it fells weird
ECould you share which language, and what the current & expected translations are? I can pass it along
Dwhy does the
http.request.uri.args["ttl"][0] not work?
KI don’t think so, the WAF doesn’t have access to your R2 tokens
Dall good, I ended up just doing a regular HMAC rule.
Cohm, I can't
Add domain more in my Access -> Applications
Thi guys, is there anyway to add
CORP header to .cloudflareaccess.com preflight response?
DSpanish.
Current translation:
Verificar que usted es un ser humano
Expected:
Verificando que usted es un ser humano
Current translation:
Verificar que usted es un ser humano
Expected:
Verificando que usted es un ser humano
EThanks!
EI passed this to the challenges team and they will fix the translation, thanks for your help
CIt doesn't work
Edo you have a proxied DNS record?
DDo modified response headers resulting from a transform rule get cached?
Thi guys, how can I add CORP header to
.cloudflareaccess.com response? My page is serving some assets from R2 custom domain and both of them are guarded by CF Access. Normally when I logged into my page (via zero trust) then content from R2 custom domain will automatically be authorized too. But now since my page has some requirements which needs COEP header to be require-corp, I cant automatically authorize access to R2 domain anymore but manually going to that R2 domain then verify because the .cloudflareaccess.com domain does not contain CORP headerTthis problem used to happen with turnstile but it was fix a while ago
Tit's really inconvenient to force users to goto R2 custom domain.
Clol yea it'd be nice. We don't even have colo name in ruleset engine atm
Dwe actually do have
cf.colo.id it seemsCyea but not name
Cid is just the numerical number assigned, not the iata airport code
Cyou could potentially make an auto updating redirect rule using that though
DI couldn't figure it out, but couldn't we use lookup_json_string to convert the id to a name?
Cwhat would you be looking up off?
Clike hardcoding the entire json list of colos, and then looking up for region?
Dhmm, doesn't
substring(cf.ray_id, 17) get you most of the way there?DI get
MIA for my location.Dit seems to complain that the json isn't dynamic too
CI think the end problems are the same though, what if it's a brand new colo not in that list?
