Cloudflare is expanding its web application firewall with full-transaction detections and response rules, the company said on October 21.
The capability evaluates an HTTP request alongside the response returned by an application’s origin. That gives the WAF additional evidence to determine not only whether an input appears malicious, but also whether the application may have processed it successfully.
Cloudflare said this approach is intended to address attacks where the response reveals whether an exploit worked. For example, a suspicious path-traversal request followed by a response containing configuration data can provide stronger evidence of sensitive-data exposure than the request alone.
Detection and blocking are separate steps
The new detections attach metadata to requests and responses, while rules determine how to respond. Customers can use Cloudflare-managed protections or create policies based on request and response properties.
When a response rule identifies a confirmed or likely exploit, Cloudflare said it can replace the origin response with a block page and an HTTP 403 before the content reaches the requester. Separating detection from mitigation also lets security teams review findings in Security Analytics before deciding how aggressively to act.
Cloudflare said the initial managed protections target the recently disclosed php2shell vulnerability. The company described the new capabilities as generally available to all customers, including those on Free plans.
The company framed response-aware inspection as a way to reduce the trade-off between broad request signatures, which can create false positives, and narrower rules that may allow ambiguous traffic through. It also said the feature is designed for an environment in which automated systems can repeatedly adapt attack payloads based on application feedback.