WAF - Leaked credentials detection now scans Authorization headers
Leaked credentials detection now automatically scans the Authorization header for Basic Authentication credentials, expanding coverage beyond request bodies and query strings. Credentials are compared against Cloudflare's leaked credentials database and populate existing WAF fields without requiring configuration changes.
Leaked credentials detection now scans the Authorization request header for Basic Authentication credentials. Previously, the detection only inspected request bodies, query strings, and headers for well-known web applications or custom detection locations, which meant credentials sent through HTTP Basic Authentication were not covered by default.
This new default scan location decodes the Authorization: Basic <credentials> header and compares the extracted username and password against Cloudflare's database of leaked credentials, the same way as other default scan locations. Matches populate the existing leaked credentials fields, such as cf.waf.credential_check.password_leaked, and trigger the Exposed-Credential-Check managed transform header if configured, so you can reuse existing custom rules and rate limiting rules without changes.
This change was applied automatically for zones with leaked credentials detection enabled. No configuration changes are required.
For more information, refer to Leaked credentials detection.
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Improved HTTP/3 client cancellation reporting
Cloudflare now properly stops HTTP/3 requests when clients cancel them and reports these consistently as 499 status codes. This reduces unnecessary origin work and provides clearer visibility into client behavior across all plan types.
WAF failed detections field now available in Rules
A new cf.appsec.request.failed_detections field lets you control how rules handle requests when security detections fail. This array of detection IDs covers content scanning, WAF attack scoring, attack signatures, leaked credentials, and AI-based PII/prompt injection/custom topic detection failures, and works across custom rules, rate limiting rules, and request header transform rules.
Markdown for Agents: More efficient in-process streaming conversion
Markdown for Agents now uses an in-process streaming engine at the edge to convert HTML, reducing overhead and memory use. The conversion limit increased from 2 MiB to 6 MiB, and token count headers are no longer generated.