Fields

Represents the entire cookie as a string.

Example value:
session=8521F670545D7865F79C3D7BEDC29CCE;-background=light

Represents the host name used in the full request URI.

Example value:
www.example.org

Represents the HTTP Referer request header, which contains the address of the web page that linked to the currently requested page.

Example value:
Referer: htt­ps://developer.example.org/en-US/docs/Web/JavaScript

Represents the full URI as received by the web server (does not include #fragment, which is not sent to web servers).

Example value:
htt­ps://www.example.org/articles/index?section=539061&expand=comments

Represents the HTTP method, returned as a string of uppercase characters.

Example value:
GET

Represents the Cookie HTTP header associated with a request as a Map (associative array).

Cookie values are not pre-processed and retain the case used in the request.

Decoding: Cookie names are URL decoded. If two cookies have the same name after decoding, their value arrays are merged.

Example:
any(http.request.cookies["app"][*] == "test")

Example value:
{"app": ["test"]}

Represents the timestamp when Cloudflare received the request, expressed as Unix time in seconds. This value is 10 digits long.

Example value:
1484063137

When validating HMAC tokens in an expression, pass this field as the currentTimestamp argument to the is_timed_hmac_valid_v0() validation function.

Represents the URI path and query string of the request.

Example value:
/articles/index?section=539061&expand=comments

Represents the URI path of the request.

Example value:
/articles/index

Represents the entire query string, without the ? delimiter.

Example value:
section=539061&expand=comments

Represents the HTTP user agent, a request header that contains a characteristic string to allow identification of the client operating system and web browser.

Example value:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36

Represents the version of the HTTP protocol used. Use this field when you require different checks for different versions.

Example Values:

• HTTP/1.1
• HTTP/3

Represents the full X-Forwarded-For HTTP header.

Example value:
203.0.113.195, 70.41.3.18

Represents the client TCP IP address, which may be adjusted to reflect the actual address of the client by using, for example, HTTP headers such asX-Forwarded-For or X-Real-IP.

Example value:
93.184.216.34

Represents the 16- or 32-bit integer representing the Autonomous System (AS) number associated with client IP address.

• AF – Africa
• AN – Antarctica
• AS – Asia
• EU – Europe
• NA – North America
• OC – Oceania
• SA – South America
• T1 – Tor network

Represents the 2-letter country code in ISO 3166-1 Alpha 2Open external link format.

Example value:
GB

For more information on the ISO 3166-1 Alpha 2 format, see ISO 3166-1 Alpha 2Open external link on Wikipedia.

Represents the ISO 3166-2 code for the first level region associated with the IP address. When the actual value is not available, this field contains an empty string.

Example value:
GB-ENG

For more information on the ISO 3166-2 standard and the available regions, see ISO 3166-2Open external link on Wikipedia.

Represents the ISO 3166-2 code for the second level region associated with the IP address. When the actual value is not available, this field contains an empty string.

Example value:
GB-SWK

For more information on the ISO 3166-2 standard and the available regions, see ISO 3166-2Open external link on Wikipedia.

Returns true when the request originates from an EU country.

Similar to the http.request.full_uri non-raw field. Represents the full URI as received by the web server without the URI fragment (if any) and without any transformation.

Note: This raw field may include some basic normalization done by Cloudflare's HTTP server. However, this can change in the future.

Similar to the http.request.uri non-raw field. Represents the URI path and query string of the request without any transformation.

Note: This raw field may include some basic normalization done by Cloudflare's HTTP server. However, this can change in the future.

Similar to the http.request.uri.path non-raw field. Represents the URI path of the request without any transformation.

Note: This raw field may include some basic normalization done by Cloudflare's HTTP server. However, this can change in the future.

Similar to the http.request.uri.query non-raw field. Represents the entire query string without the ? delimiter and without any transformation.

Note: This raw field may include some basic normalization done by Cloudflare's HTTP server. However, this can change in the future.

Returnstrue when the HTTP connection to the client is encrypted.

cf.bot_management.verified_bot
Boolean

When true, this field indicates the request originated from a known good bot or crawler.

cf.bot_management.score
Number

Represents the likelihood that a request originates from a bot using a score from 1–99.

A low score indicates that the request comes from a bot or an automated agent. A high score indicates that a human issued the request.

When true, this field indicates the request originated from a known good bot or crawler.

Represents the edge IP address to which the HTTP request has resolved to.

This field is only meaningful for BYOIP customersOpen external link.

Represents the port number at which Cloudflare's network received the request.

Use this field to filter traffic on a specific port. The value is a port number in the range 1–65535.

Represents a Cloudflare threat score from 0–100, where 0 indicates low risk. Values above 10 may represent spammers or bots, and values above 40 identify bad actors on the internet.

It is rare to see values above 60. A common recommendation is to challenge requests with a score above 10 and to block those above 50.

Returns true when a request presents a valid but revoked client certificate.

When true, the cf.tls_client_auth.cert_verified field is also true.

Returns true when a request presents a valid client certificate.

Also returns true when a request includes a valid certificate that was revoked (see cf.tls_client_auth.cert_revoked).

Identifies whether a request comes from a worker or not.

When a request comes from a worker, this field will hold the name of the zone for that worker. Otherwise cf.worker.upstream_zone is empty

cf.colo.name
String

cf.colo.region
String

icmp
String

icmp.type
Number

icmp.code
Number

ip
String

ip.dst
IP Address

ip.geoip.country
String

For more information on the ISO 3166-1 Alpha 2 format, see ISO 3166-1 Alpha 2Open external link on Wikipedia.

ip.hdr_len
Number

ip.len
Number

ip.opt.type
Number

ip.proto
String

ip.src
IP Address

ip.ttl
Number

tcp
String

tcp.flags
Number

tcp.flags.ack
Boolean

tcp.flags.cwr
Boolean

tcp.flags.ecn
Boolean

tcp.flags.fin
Boolean

tcp.flags.push
Boolean

tcp.flags.reset
Boolean

tcp.flags.syn
Boolean

tcp.flags.urg
Boolean

tcp.srcport
Number

tcp.dstport
Number

udp
String

udp.dstport
Number

udp.srcport
Number

Represents the HTTP URI arguments associated with a request as a Map (associative array).

When an argument repeats, then the array contains multiple items in the order they appear in the request.

Values are not pre-processed and retain the case used in the request.

Decoding: no decoding performed
Non-ASCII: preserved

Example:
any(http.request.uri.args["search"][*] == "red+apples")

Example value:
{"search": ["red+apples"]}

Represents the names of the arguments in the HTTP URI query string. Names are not pre-processed and retain the case used in the request.

When a name repeats, the array contains multiple items in the order that they appear in the request.

Decoding: no decoding performed
Non-ASCII: preserved

Example:
any(http.request.uri.args.names[*] == "search")

Example value:
["search"]

Represents the values of arguments in the HTTP URI query string. Values are not pre-processed and retain the case used in the request. They are in the same order as in the request.

Duplicated values are listed multiple times.

Decoding: no decoding performed
Non-ASCII: preserved

Example:
any(http.request.uri.args.values[*] == "red+apples")

Example value:
["red+apples"]

Contains the same field values as http.request.uri.args.

Contains the same field values as http.request.uri.args.names.

Contains the same field values as http.request.uri.args.values.

Represents HTTP request headers as a Map (or associative array).

When there are repeating headers, the array includes them in the order they appear in the request. The keys convert to lowercase.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Example:
any(http.request.headers["content-type"][*] == "application/json")

Example value:
{"content-type": ["application/json"]}

Represents the names of the headers in the HTTP request. The names are not pre-processed and retain the case used in the request.

The order of header names is not guaranteed but will match http.request.headers.values.

Duplicate headers are listed multiple times.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Example:
any(http.request.headers.names[*] == "content-type")

Example value:["content-type"]

Represents the values of the headers in the HTTP request.

Values are not pre-processed and retain the case used in the request.

The order of header values is not guaranteed but will match http.request.headers.names.

Duplicate headers are listed multiple times.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Example 1:
any(http.request.headers.values[*] == "application/json")

Example value 1:
["application/json"]

Additionally used for logging requests according to the specified operator and the length/size entered for the header value.

Example 2:
any(len(http.request.headers.values[*])[*] gt 10)

Example value 2:
["gt 10"]

Returns true when the HTTP request contains too many headers; otherwise, returns false.

When true, http.request.headers, http.request.headers.names, and http.request.headers.values may not contain all of the headers sent in the HTTP request.

Represents the unaltered HTTP request body.

When the value of http.request.body.truncated is true, the return value may be truncated.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Indicates whether the HTTP request body is truncated.

When true, http.request.body fields may not contain all of the HTTP request body.

Represents the HTTP request body of a form as a Map (or associative array). Populated when the Content-Type header is application/x-www-form-urlencoded.

Values are not pre-processed and retain the case used in the request. When a field repeats, then the array contains multiple items in the order they are in the request.

The return value may be truncated if http.request.body.truncated is true.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Example:
any(http.request.body.form["username"][*] == "admin")

Example value:
{username": ["admin"]}

Represents the names of the form fields in an HTTP request where the content type is application/x-www-form-urlencoded.

Names are not pre-processed and retain the case found in the request. They are listed in the same order as in the request. Duplicate names are listed multiple times.

The return value may be truncated if http.request.body.truncated is true.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Example:
any(http.request.body.form.names[*] == "username")

Example value:
["username"]

Represents the values of the form fields in an HTTP request where the content type is application/x-www-form-urlencoded.

Values are not pre-processed and retain the case used in the request. They are in the same order as in the request.

Duplicated values are listed multiple times.

The return value may be truncated if http.request.body.truncated is true.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Example:
any(http.request.body.form.values[*] == "admin")

Example value:
["admin"]