Skip to content

[Gateway] Tenant control WAF custom header procedure #20185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 26, 2025
Merged

[Gateway] Tenant control WAF custom header procedure #20185

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6fad415
Add WAF custom header procedure
maxvp Feb 21, 2025
aea8b1a
Add better explanation
maxvp Feb 21, 2025
48f965b
Apply suggestions from code review
maxvp Feb 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions src/content/docs/cloudflare-one/policies/gateway/http-policies/tenant-control.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,22 @@ For more information, refer to the [Slack documentation](https://slack.com/help/

For more information, refer to the [Dropbox documentation](https://help.dropbox.com/security/network-control).

## Exempt users in Cloudflare WAF

You can include custom headers in an HTTP policy to allow your users through [Cloudflare WAF](/waf/). This is useful for allowing only WARP users through your WAF.

1. Create an Allow policy for an internal domain behind your WAF with a custom header.

| Selector | Operator | Value | Action |
| -------- | -------- | ----------------- | ------ |
| Domain | in | `internalapp.com` | Allow |

| Custom header name | Custom header value |
| ------------------ | ------------------- |
| `X-Example-Header` | `example-value` |

2. In Cloudflare WAF, [create a custom rule](/waf/custom-rules/) to [require the same HTTP header](/waf/custom-rules/use-cases/require-specific-headers/#example-2-require-http-header-with-a-specific-value).

## Use tenant control with Browser Isolation

You can configure [Browser Isolation](/cloudflare-one/policies/browser-isolation/) to send custom headers. This is useful for implementing tenant control for isolated SaaS applications or sending arbitrary custom request headers to isolated websites.
Expand Down
Loading