Domain access control lists (ACLs) control which destinations a deployment can reach. Use the Basic Auth page to manage credentials and their secrets. To understand how these controls relate to request policies, refer to Request Validation.
You need access to manage Cloud Workload Security in your account.
A domain ACL contains domain-specific actions and a default action. The default action applies when no domain entry matches.
-
In the Cloudflare dashboard, select your account and go to Cloud Workload Security > Traffic scope > Domain ACLs.
Go to Domain ACLs ↗ -
Select Add a domain ACL and enter a Name.
-
Choose Allow or Block for Default action.
-
In Domains, select Add domain. Enter a Domain and choose its Action. For example, block
api.example.comwith a default action of Allow. -
Select Add a domain ACL to save the list.
Use example.com for an exact domain match. Use .example.com to match the parent domain and its subdomains.
-
In the Cloudflare dashboard, go to Cloud Workload Security > Deployments and open the deployment.
Go to Deployments ↗ -
In Domain ACL, select from the list and select Save.
-
After the proxy refreshes its configuration, test an allowed destination and a blocked destination through it.
An ACL allow decision permits the connection. CWS policies can still block API requests on that connection.
To detach the list, select None in Domain ACL and select Save. Detach an ACL from its deployments before deleting it.
Basic Auth credentials are separate from the Cloudflare API token used in your proxy configuration.
-
In the Cloudflare dashboard, go to Cloud Workload Security > Traffic scope > Credentials > Basic Auth.
Go to Basic Auth credentials ↗ -
Select Create credential and enter a Username. Use printable characters without spaces or colons.
-
In Secrets, select Add a secret. Enter Password and Confirm password. Optionally, set an Expiration.
-
In the dialog, select Add a secret, then select Create credential to save the credential and its initial secret.
The username is read-only after creation. Open the credential to manage its secrets.
Use this procedure for a credential your clients already use.
-
In Basic Auth, open the credential.
-
In Secrets, select Add a secret. Enter and confirm the new password, set an optional expiration, and select Add a secret.
-
Allow the deployment configuration to refresh before updating clients to use the new password. Verify requests from those clients before deleting the old secret.
-
For the old secret, select Delete and confirm the deletion.
The secret list displays creation and expiration information. It does not display stored passwords.