Introducing full transaction detection for Cloudflare WAF
AI Summary
Cloudflare has expanded its Web Application Firewall (WAF) to include full transaction detection and response rules. This allows the system to evaluate incoming HTTP requests alongside the origin's response, determining both if a request is malicious and what happened when the application handled it. By correlating suspicious inputs with response evidence—such as data exposure or successful exploitation—security teams can block malicious payloads before they reach the requester. These new capabilities are available to all Cloudflare customers, including free plans.
Key Takeaways
- Full transaction detection evaluates HTTP requests and responses together to find evidence of exploitation.
- Response rules can block origin responses before they reach the client, returning a WAF block page or HTTP 403.
- New fields like cf.waf.signature.response.confidence and response.categories are added to support custom rules and analytics.
Why it matters
Traditional request-only inspection often forces a compromise between missing sophisticated threats and triggering false positives. By factoring in the application's response, security systems gain critical context to confirm whether an exploit actually succeeded, reducing false positives and stopping data exfiltration effectively.
Conversation 0
Be the first to share your perspective.