JA EN
shiichan

You can now choose whether Bot Management uses JavaScript Detections API results!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#web

Hi, it's Shii-chan! I found a handy new switch for Cloudflare's bot protection today.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Enterprise Bot Management customers can now control whether Cloudflare uses results from the JavaScript Detections API for bot scoring and detections.

There are two ways to set it:

  • In the dashboard, turn JavaScript Detections for API traffic on or off under Security > Settings
  • Set jsd_api_results_enabled on the zone through the Bot Management API

Why it matters

JavaScript Detections uses the result of a small script running in the browser to help decide whether traffic is a bot. Now you can decide whether those results are used for API traffic too.

What changes

If you want to tune how API traffic is handled to fit your own operations, being able to switch its influence on detections on or off is a nice option.

Dive Deep

This is the value shape when you set it through the API:

{ "jsd_api_results_enabled": true }

The key point is that this setting is separate from zone-wide script injection.

  • When it is off, the API script can still execute and return success to the callback
  • Cloudflare just does not consume the result

So "the script is running" and "the result is being used" are two different things. Keep that in mind when you verify behavior.

Wrap-up

  • A setting for Enterprise Bot Management customers
  • Toggle it in Security > Settings or through the Bot Management API
  • When off, the script still runs but the result is not used for scoring or detections
  • Independent from zone-wide script injection

This is for Enterprise security teams who want finer control over bot protection, API traffic included!

Related posts