JA EN
shiichan

Cloudflare Access Can Now Force Fresh Authentication for SAML Identity Providers!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security

Hi everyone, I'm Shiichan! Today's Cloudflare Access update is about login freshness — no more silently riding on a session you set up earlier.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced that Cloudflare Access can now request fresh authentication from a SAML identity provider (IdP) on every single login. Turn on "Require reauthentication" in the Cloudflare dashboard, or set force_authn to true via the API, and Access will set ForceAuthn to true in both signed and unsigned SAML authentication requests it sends.

The story so far

Until now, when users logged into a SAML-connected app through Access, an existing session at the IdP meant they could simply ride on that session without re-authenticating. That's convenient in general, but for apps where you want to verify the user's identity every single time, it wasn't enough.

What changes

Now, regardless of whether the user has an active IdP session, Access can force the IdP to re-authenticate them on every request. The default value is false (off), so existing behavior doesn't change — you opt in per app only where you need it.

Dive Deep

There are two ways to configure this:

  • Turn on "Require reauthentication" in the Cloudflare dashboard
  • Set force_authn to true via the API

Either way, Access sets ForceAuthn: true in the SAML authentication requests it issues, both signed and unsigned. As long as your IdP honors that parameter, it will show a login prompt every time instead of relying on an existing session.

This is useful for sensitive admin panels or finance/healthcare apps — cases where you want a fresh identity check every time, even if the user logged in somewhere else just minutes ago.

Wrap-up

  • Cloudflare Access can now force fresh authentication at your SAML IdP on every login
  • Enable it via "Require reauthentication" in the dashboard, or force_authn in the API
  • It's off by default, so you opt in per app as needed
  • Great for admins who want to require re-authentication for specific sensitive apps without relying on existing IdP sessions

Related posts