JA EN
shiichan

Cloudflare Access Logins for Plaintext HTTP Private Apps Now Open Right in Your Browser!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hi everyone, it's Shiichan! I found a small but genuinely nice update today, so let's dig in.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog has an improvement for Access private applications. For private apps served over plaintext HTTP (port 80), Access now uses the standard browser-based login flow.

The story so far

Until now, HTTP private apps used the same session flow as non-HTTP protocols like SSH and RDP. When a user hit the app, they'd get an "Authentication required" pop-up from the Cloudflare One Client, then had to select that notification to open a browser and log in — a bit of a detour.

What changes

Now, when you hit an HTTP private app, the Access login page shows up directly in your browser. Once you log in successfully, you get a standard Access application token, just like that. This brings the HTTP experience in line with HTTPS apps that have Gateway TLS decryption turned on. And the best part: no configuration change is required to get this.

The Cloudflare One Client is still required to route traffic to the private network, so that hasn't changed. What has changed is that the Client no longer manages the Access session for HTTP apps. SSH, RDP, and other non-HTTP protocols still use the same Client notification flow as before, so keep that in mind.

Wrap-up

  • Cloudflare's Changelog: Access private apps over plaintext HTTP now support browser-based login
  • Previously they used the same notification flow as SSH/RDP; now the login page opens directly in the browser
  • Unifies the experience with HTTPS apps (Gateway TLS decryption), and no config change is needed
  • The Cloudflare One Client is still needed for routing, but no longer manages the HTTP app's Access session
  • Non-HTTP protocols like SSH and RDP keep using the existing notification flow

If your team exposes internal tools as plaintext HTTP private apps through Cloudflare Access, this is a small but genuinely welcome improvement!

Related posts