Cloudflare service token authentication

[jonathon2nd]

⚠️ Please verify that this question has NOT been raised before.

• I checked and didn't find similar issue

🛡️ Security Policy

• I agree to have read this project Security Policy

📝 Describe your problem

I would like to use service token to connect to websites protected by cloudflare zero trust
https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/
I can get it working with header

{
    "CF-Access-Client-Id": "",
    "CF-Access-Client-Secret": ""
}

It would be nice to not have CF-Access-Client-Secret in plain text.

Wondering if there is a way to do this already that I am missing.

I thought something like this might work, but not sure what to do about the URL

📝 Error Message(s) or Log

No response

🐻 Uptime-Kuma Version

Helm uptime-kuma:2.19.1

💻 Operating System and Arch

k8s

🌐 Browser

n/a

🖥️ Deployment Environment

Helm deployment:
uptime-kuma:2.19.1

[CommanderStorm]

would be nice to not have CF-Access-Client-Secret in plain text.

The headers field you noted is plain text.. am I missing something?

[jonathon2nd]

I was wondering if there was some way to have CF-Access-Client-Secret protected as a secret, and not have it in plain text.

[evelynmatson]

Can you share the whole config you used to get this working? i put in my access token to the headers field with the syntax you suggested, but it's still not working (always showing "up" even if the service is down, beause it's hitting the login page i believe)

[jonathon2nd]

Added the following to the headers section

{
    "CF-Access-Client-Id": "eee",
    "CF-Access-Client-Secret": "eee"
}

which sucks cause as I have stated, CF-Access-Client-Secret needs to be protected, and not stored in plain text here.

[bartoszcholewa]

Can you share the whole config you used to get this working? i put in my access token to the headers field with the syntax you suggested, but it's still not working (always showing "up" even if the service is down, beause it's hitting the login page i believe)

@evelynmatson and for anyone to whom the server responds 200 OK using the service token, even though the application is down. Step-by-step:

1. Make sure your application is actually unavailable behind Cloudflare Application Auth (im using Google Identity provider)
   Im using incongito mode for peace of mind

   
   

2. Create your Service Token CF-Access-Client-Id and CF-Access-Client-Secret

   

3. Add new policy to your application (dont extend your Access group, add it individualy)

   

4. Fill up:

   • Policy Name: Your name
   • Action: Service Auth >>>> IMPORTANT <<<<<
   • Session Duration: No duration OPTIONAL
   • 401 Response Checked - If you want to get response 401 at no auth OPTIONAL
   • Include
     • Selector: Service Token
     • Value: Your Token

   
   

   Save

   

5. Go to Uptime Kuma, edit your monitor, add header, Save

   

6. Done

   

7. Lets bring up out application to live to verify

   
   

My setup:

• website on Dedicated Server on Cloud Provider
• Uptime Kuma on local

[github-actions]

We are clearing up our old help-issues and your issue has been open for 60 days with no activity.
If no comment is made and the stale label is not removed, this issue will be closed in 7 days.