Cloudflare authorization cookie
When you protect a site with Cloudflare Access, Cloudflare checks every HTTP request bound for that site to ensure that the request has a valid
CF-Authorization cookie. If a request does not include the cookie, Access will block the request.
CF-Authorization cookie contains the user’s identity in the form of a JSON Web Token (JWT).Cloudflare securely creates these tokens through the OAUTH or SAML integration between Cloudflare Access and the configured identity provider.
Two tokens are generated:
Global session token: a token generated when a user logs in to Access. This token is stored as a cookie at your (for example,
https://<your-team-name>.cloudflareaccess.com) and prevents a user from needing to log in to each application.
Cloudflare Access provides optional security settings that can be added to the browser cookies generated by Access for an authenticated user. The three enhanced browser cookie settings available are:
To enable these settings:
Locate the application you would like to configure and click Edit.
Click Settings and scroll down to Cookie settings.
Configure the desired cookie settings.
Click Save application.
The selector options are:
- None - Cookies will be sent in all contexts, including cross-origin requests.
- Lax - Cookies are allowed to be sent with top-level navigations and will be sent along with GET requests initiated by third party websites.
- Strict - Cookies will only be sent in a first-party context and not be sent along with requests initiated by third party websites.
When not to use SameSite
Do not enable SameSite restrictions if you have additional sites or applications that rely on a specific application’s authorization cookie.
The HttpOnly flag is a cookie attribute that prevents the cookie from being accessed by any client-side scripts, reducing the likelihood of Cross-Site Scripting (XSS) attacks. This flag is enabled by default.
When not to use HttpOnly
Do not enable HttpOnly if:
- You are using the Access application for non-browser based tools.
- You have software that relies on being able to access a user’s cookie generated by Access.
The Binding Cookie is an additional cookie created when a user successfully authenticates, shared with Cloudflare to verify identity, and then stripped before it reaches the origin server. The Binding Cookie associates the browser with the Access token; the association protects against compromised authorization tokens because the origin webapp would never see this binding cookie. This protects against session hijack style attacks.
When not to use the Binding Cookie
Do not use the Binding Cookie for non-browser based Access applications that rely on protocols like SSH, RDP, etc.
Allow cross-site cookies in Firefox
By default, Firefox Private Browsing mode blocks all cross-site cookies including the
CF-Authorization cookie. For XHR requests to work in private windows, you will need to exempt your site and from the browser’s tracking protection system.
To enable cross-site cookies in Firefox:
- In Firefox, go to Settings > Privacy & Security.
- Scroll down to Cookies and Site Data.
- Select Manage Exceptions.
- Enter the URL of your Access application (for example,
https://jira.site.com) and select Allow.
https://<your-team-name>.cloudflareaccess.comand select Allow.
- Select Save Changes.
You can now make XHR requests to your Access application in Firefox Private Browsing mode.