Cloudflare WAF's leaked credential detection now covers Basic Auth passwords too!

Hey everyone, it's me, Shii-chan! Today I found a small but important gap that Cloudflare's WAF just closed, so let's take a look.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, they announced that the WAF's Leaked Credentials Detection now also scans the Authorization header of HTTP requests.

Specifically, it automatically decodes the Authorization: Basic header and checks the username and password inside it against Cloudflare's database of leaked credentials. So apps that log people in with Basic Authentication now get checked for reused, already-leaked passwords too.

The story so far

Leaked Credentials Detection originally only scanned request bodies, query strings, and known headers set up for major web applications (or custom detection locations configured by an admin).

That meant credentials sent through HTTP Basic Authentication weren't covered by the default scan. Basic Auth is still a common, simple way to protect internal tools and APIs, so it's a bit surprising that this spot was left unchecked.

What changes

For apps and endpoints that use Basic Authentication, Cloudflare can now catch attempts to log in with a leaked username-and-password combination. No configuration changes are needed either — it's already applied automatically to zones that have Leaked Credentials Detection enabled.

Results still land in the existing fields, like cf.waf.credential_check.password_leaked, and if you have the Exposed-Credential-Check managed transform header configured, that still fires the same way. So your existing custom rules and rate limiting rules keep working, and their coverage just got wider for free.

Dive Deep

The technical detail worth calling out is that the decoding and matching logic for the Basic Auth header runs through exactly the same mechanism as the other default scan locations, like request bodies and query strings. Rather than bolting on a special separate rule, Cloudflare simply added one more scan target to the existing detection pipeline — a simple, focused extension.

Wrap-up

• Cloudflare WAF's Leaked Credentials Detection now also scans Basic Authentication credentials in the Authorization header
• Previously it only looked at request bodies, query strings, and known headers — Basic Auth wasn't covered
• Matches flow into the same existing fields and managed transform header, so no rule changes are needed
• It's already applied automatically to affected zones, with no setup required

If you're still running internal tools or legacy APIs behind Basic Authentication, your protection just quietly got a bit stronger — nice bonus!