Sequence Mitigation custom rules

API Shield sequence custom rules use the configured API Shield session identifier to track the order of requests a user has made and the time between requests, and makes them available via Cloudflare Rules. This allows you to write rules that match valid or invalid sequences.

These rules are different from cookie sequence rules in a few ways:

• They only require an API Shield subscription.
• They require session identifiers to be set in API Shield.
• Because they use an API's session identifiers, they can be used for APIs designed for mobile applications.
• Because Cloudflare stores the user state in memory and not in a cookie, the session lifetime is limited to 10 minutes.

Rules built using these custom rules are different from sequence mitigation rules built via API or the Cloudflare dashboard. The custom rules syntax enables free-form logic and response options that the dashboard does not.

Availability

These sequence fields are available in:

• Custom rules (http_request_firewall_custom phase)
• Rate limiting rules (http_request_ratelimit)
• Bulk redirects (http_request_redirect)
• HTTP request header modification rules (http_request_late_transform)

Field name	Description	Example value
cf.sequence.current_op String	This field contains the ID of the operation that matches the current request. If the current request does not match any operations defined in Endpoint Management, it will be an empty string.	c821cc00
cf.sequence.previous_ops Array<String>	This field contains an array of the prior operation IDs in the sequence, ordered from most to least recent. It does not include the current request. If an operation is repeated, it will appear multiple times in the sequence.	["f54dac32", "c821cc00", "a37dc89b"]
cf.sequence.msec_since_op Map<Number>	This field contains a map where the keys are operation IDs and the values are the number of milliseconds since that operation has most recently occurred. This does not include the current request or operation as it only factors in previous operations in the sequence.	{"f54dac32": 1000, "c821cc00": 2000}

Example rules

Each saved endpoint will have an endpoint ID visible in its details page in Endpoint Management in the form of a UUID. The references below (aaaaaaaa, bbbbbbbb, and cccccccc) are the first eight characters of the endpoint ID.

The visitor must wait more than 2 seconds after requesting endpoint aaaaaaaa before requesting endpoint bbbbbbbb:

cf.sequence.current_op eq "bbbbbbbb" and
cf.sequence.msec_since_op["aaaaaaaa"] ge 2000

The visitor must request endpoints aaaaaaaa, then bbbbbbbb, then cccccccc in that exact order:

cf.sequence.current_op eq "cccccccc" and
cf.sequence.previous_ops[0] == "bbbbbbbb" and
cf.sequence.previous_ops[1] == "aaaaaaaa"

The visitor must request endpoint aaaaaaaa before endpoint bbbbbbbb, but endpoint aaaaaaaa can be anywhere in the previous 10 requests:

cf.sequence.current_op eq "bbbbbbbb" and
any(cf.sequence.previous_ops[*] == "aaaaaaaa")

The visitor must request either endpoint aaaaaaaa before endpoint bbbbbbbb, or endpoint cccccccc before endpoint bbbbbbbb:

(cf.sequence.current_op eq "bbbbbbbb" and
any(cf.sequence.previous_ops[*] == "aaaaaaaa")) or
(cf.sequence.current_op eq "bbbbbbbb" and
any(cf.sequence.previous_ops[*] == "cccccccc"))

Was this helpful?

What did you like?

Accurate

Easy to understand

Solved my problem

Helped me decide to use the product

Other

What went wrong?

Hard to understand

Incorrect information

Missing the information

Other

Thank you for helping improve Cloudflare's documentation!