JA EN
shiichan

Enforce Positive Security with Cloudflare Application Profiles

Cloudflare Blog ★★★ View Markdown
#cloudflare#security#web

Hi, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

This new feature has a fun idea: instead of hunting attack patterns, it learns what a correct request looks like and finds anything that deviates. I love it!

What was announced?

The Cloudflare Blog introduced Application Profiles. Cloudflare learns the structure of your HTTP requests and identifies deviations. Since AI makes it easier for attackers to generate and vary payloads, this adds a positive security layer that helps reduce attack surface.

Why it matters

Traditional WAFs mostly look for known attack signatures, a negative model. If attacks vary endlessly, chasing signatures is hard. Defining the correct shape and stopping everything else is more likely to help against unknown variants.

What changes

  • You don't have to write schemas by hand, because the legitimate shape is learned from real traffic
  • Each request is enriched with metadata about whether it conforms, so you can review analytics before enforcing
  • Non-conforming requests can be blocked with Security Rules

Dive Deep

The system analyzes successful (2xx) traffic to learn the following.

  • Structure of path variables, query parameters, headers, cookies, and bodies
  • Data types: integers, strings, booleans, arrays, UUIDs, enums
  • Constraints: numeric ranges, string lengths, character classes

Learning needs a minimum volume: an operation needs at least 1,000 qualifying requests weekly to learn basic fields and 10,000 to establish data boundaries. Learning runs automatically once a week per zone.

Here is availability.

  • Available now: customers with existing API Security
  • Beta: Enterprise customers without API Security (by invitation only)
  • Supported elements: paths, query parameters, headers, cookies, JSON bodies, form-encoded bodies
  • Unsupported: multipart forms, GraphQL, XML

Nothing is enforced automatically. You must create Security Rules to block non-conforming requests.

There are limitations.

  • It does not enforce required parameters
  • It cannot enforce parameter uniqueness
  • It does not block a request solely for containing a new parameter
  • It validates repeated parameter values but doesn't enforce their uniqueness
  • Enums support a maximum of three values

Wrap-up

  • Application Profiles learns the structure of normal HTTP requests and finds deviations
  • Learning runs weekly and needs 1,000+ requests per operation per week (10,000+ to establish boundaries)
  • It is available now with API Security, and in beta by invitation for Enterprise
  • You enable blocking by creating Security Rules yourself

This is for security teams who expose APIs and struggle with attack variants!

Related posts