导航|地址|刷新
Fields reference

Skip to content

Docs Directory API SDKs Changelog

Search

Log in

Ruleset Engine

/

Overview

About

Overview

Phases

Rulesets

Rules

Basic API operations

View rulesets

Add rules to phase entry point rulesets

Deploy rulesets

Work with managed rulesets

Overview

Deploy a managed ruleset

Override a managed ruleset

Override examples

Overview

Set WordPress rules to Block

Enable only Joomla rules

Enable only selected rules

Deploy a managed ruleset with ruleset, tag, and rule overrides

Adjust the sensitivity of an HTTP DDoS rule to Low

Adjust an L3/4 DDoS rule ↗

Create an exception

Work with custom rulesets

Overview

Create a custom ruleset

Add rules to a custom ruleset

Deploy a custom ruleset

Rules language

Overview

Expressions

Overview

Edit in the dashboard

Operators and grouping symbols

Values

Actions

Fields

Overview

Fields reference

Functions

Rulesets API

Overview

JSON objects

Endpoints

List and view rulesets

Create a ruleset

Update or deploy a ruleset

Add a rule to a ruleset

Update a rule in a ruleset

Delete a rule in a ruleset

Delete a ruleset

Reference

Phases list

Home

/Ruleset Engine

/…
Rules language

/Fields

/Fields reference

Fields reference

Copy as Markdown|View as Markdown|Agent setup

Categories Body Bots Geolocation Headers JWT validation Raw fields Request Response SSL/TLS URI mTLS

cf.api_gateway.auth_id_present

Indicates whether the request contained an API session authentication token, as defined by API Shield's saved session identifiers .

Enterprise add-on

cf.api_gateway.fallthrough_detected

Indicates whether the request matched a saved endpoint in Endpoint Management .

cf.api_gateway.request_violates_schema

Indicates whether the request violated the schema assigned to the respective saved endpoint.

cf.bot_management.corporate_proxy

Indicates whether the incoming request comes from an identified Enterprise-only cloud-based corporate proxy or secure web gateway.

Enterprise add-on

cf.bot_management.detection_ids

List of IDs that correlate to the Bot Management heuristic detections made on a request.

Enterprise add-on

cf.bot_management.ja3_hash

Provides an SSL/TLS fingerprint to help you identify potential bot requests.

Enterprise add-on

cf.bot_management.ja4

Provides an SSL/TLS fingerprint to help you identify potential bot requests.

Enterprise add-on

cf.bot_management.js_detection.passed

Indicates whether the visitor has previously passed a JS Detection.

Enterprise add-on

cf.bot_management.score

Represents the likelihood that a request originates from a bot using a score from 1–99.

Enterprise add-on

cf.bot_management.signed_agent

Indicates whether or not the request originated from a known agent that self-identifies with Web Bot Auth, now classified as a verified bot or agent labeled as intermediary.

Enterprise add-on

cf.bot_management.static_resource

Indicates whether static resources should be included when you create a rule using cf.bot_management.score.

Enterprise add-on

cf.bot_management.verified_bot

Indicates whether the request originated from a known good bot or crawler.

Enterprise add-on

cf.client.bot

Indicates whether the request originated from a known good bot or crawler.

cf.edge.client_tcp

Indicates if the request was made over TCP.

cf.edge.l4.delivery_rate

The most recent data delivery rate estimate for the client connection, in bytes per second.

cf.edge.server_ip

Represents the global network's IP address to which the HTTP request has resolved.

cf.edge.server_port

Represents the port number at which the Cloudflare global network received the request.

cf.hostname.metadata

Returns the string representation of the per-hostname custom metadata JSON object set by SSL for SaaS customers.

cf.llm.prompt.custom_topic_categories

A map of custom topic labels to relevance scores (1–99) for the LLM prompt in the request.

Enterprise

cf.llm.prompt.detected

Indicates whether Cloudflare detected an LLM prompt in the incoming request.

Enterprise

cf.llm.prompt.injection_score

A score from 1–99 that represents the likelihood that the LLM prompt in the request is trying to perform a prompt injection attack.

Enterprise

cf.llm.prompt.pii_categories

Array of string values with the personally identifiable information (PII) categories found in the LLM prompt included in the request.

Enterprise

cf.llm.prompt.pii_detected

Indicates whether any personally identifiable information (PII) has been detected in the LLM prompt included in the request.

Enterprise

cf.llm.prompt.token_count

An estimated token count for the LLM prompt in the request.

Enterprise

cf.llm.prompt.unsafe_topic_categories

Array of string values with the type of unsafe topics detected in the LLM prompt.

Enterprise

cf.llm.prompt.unsafe_topic_detected

Indicates whether the incoming request includes any unsafe topic category in the LLM prompt.

Enterprise

cf.random_seed

Returns per-request random bytes that you can use in the uuidv4() function.

cf.ray_id

The Ray ID of the current request.

cf.response.1xxx_code

Contains the specific code for 1XXX Cloudflare errors.

cf.response.error_type

A string with the type of error in the response being returned.

cf.threat_score

Represents a Cloudflare threat score.

cf.timings.client_quic_rtt_msec

The smoothed QUIC round-trip time (RTT) between Cloudflare and the client in milliseconds.

cf.timings.client_tcp_rtt_msec

The smoothed TCP round-trip time (RTT) between Cloudflare and the client in milliseconds.

cf.timings.edge_msec

The time spent processing a request within the Cloudflare global network in milliseconds.

cf.timings.origin_ttfb_msec

The round-trip time (RTT) between the Cloudflare global network and the origin server in milliseconds.

cf.timings.worker_msec

The time spent executing a Cloudflare Worker in milliseconds.

cf.tls_cipher

The cipher for the connection to Cloudflare.

cf.tls_ciphers_sha1

The SHA-1 fingerprint of the client TLS cipher list in received order, encoded in Base64 using big-endian format.

cf.tls_client_auth.cert_chain_rfc9440

The mTLS client certificate chain (excluding the leaf certificate) encoded as a structured field list per RFC 9440 .

cf.tls_client_auth.cert_chain_rfc9440_too_large

Returns true when the RFC 9440 encoded client certificate chain exceeds the 16 KiB size limit.

cf.tls_client_auth.cert_fingerprint_sha1

The SHA-1 fingerprint of the mTLS client certificate.

cf.tls_client_auth.cert_fingerprint_sha256

The SHA-256 fingerprint of the mTLS client certificate.

cf.tls_client_auth.cert_issuer_dn

The Distinguished Name (DN) of the Certificate Authority (CA) that issued the mTLS client certificate.

cf.tls_client_auth.cert_issuer_dn_legacy

The Distinguished Name (DN) of the Certificate Authority (CA) that issued the mTLS client certificate in a legacy format.

cf.tls_client_auth.cert_issuer_dn_rfc2253

The Distinguished Name (DN) of the Certificate Authority (CA) that issued the mTLS client certificate in RFC 2253 format.

cf.tls_client_auth.cert_issuer_serial

Serial number of the direct issuer of the mTLS client certificate.

cf.tls_client_auth.cert_issuer_ski

The Subject Key Identifier (SKI) of the direct issuer of the mTLS client certificate.

cf.tls_client_auth.cert_not_after

The mTLS client certificate is not valid after this date.

cf.tls_client_auth.cert_not_before

The mTLS client certificate is not valid before this date.

cf.tls_client_auth.cert_presented

Returns true when an mTLS client presents a certificate (valid or not).

cf.tls_client_auth.cert_revoked

Indicates whether the mTLS client presented a valid but revoked client certificate.

cf.tls_client_auth.cert_rfc9440

The mTLS client certificate encoded as a Structured Fields Byte Sequence per RFC 9440 .

cf.tls_client_auth.cert_rfc9440_too_large

Returns true when the RFC 9440 encoded mTLS client certificate exceeds the 10 KiB size limit.

cf.tls_client_auth.cert_serial

Serial number of the mTLS client certificate.

cf.tls_client_auth.cert_ski

The Subject Key Identifier (SKI) of the mTLS client certificate.

cf.tls_client_auth.cert_subject_dn

The Distinguished Name (DN) of the owner (or requester) of the mTLS client certificate.

cf.tls_client_auth.cert_subject_dn_legacy

The Distinguished Name (DN) of the owner (or requester) of the mTLS client certificate in a legacy format.

cf.tls_client_auth.cert_subject_dn_rfc2253

The Distinguished Name (DN) of the owner (or requester) of the mTLS client certificate in RFC 2253 format.

cf.tls_client_auth.cert_verified

Returns true when an mTLS client presents a valid client certificate.

cf.tls_client_extensions_sha1

The SHA-1 fingerprint of TLS client extensions, encoded in Base64 using big-endian format.

cf.tls_client_extensions_sha1_le

The SHA-1 fingerprint of TLS client extensions, encoded in Base64 using little-endian format.

cf.tls_client_hello_length

The length of the client hello message sent in a TLS handshake .

cf.tls_client_random

The value of the 32-byte random value provided by the client in a TLS handshake , encoded in Base64.

cf.tls_version

The TLS version of the connection to Cloudflare.

cf.verified_bot_category

Provides the type and purpose of a verified bot.

cf.waf.auth_detected

Indicates whether the Cloudflare WAF detected authentication credentials in the request.

Enterprise

cf.waf.content_scan.has_failed

Indicates whether the file scanner was unable to scan any of the content objects detected in the request.

Enterprise add-on

cf.waf.content_scan.has_malicious_obj

Indicates whether the request contains at least one malicious content object.

Enterprise add-on

cf.waf.content_scan.has_obj

Indicates whether the request contains at least one content object.

Enterprise add-on

cf.waf.content_scan.num_malicious_obj

The number of malicious content objects detected in the request (zero or greater).

Enterprise add-on

cf.waf.content_scan.num_obj

The number of content objects detected in the request (zero or greater).

Enterprise add-on

cf.waf.content_scan.obj_results

An array of scan results in the order the content objects were detected in the request.

Enterprise add-on

cf.waf.content_scan.obj_sizes

An array of file sizes in bytes, in the order the content objects were detected in the request.

Enterprise add-on

cf.waf.content_scan.obj_types

An array of file types in the order the content objects were detected in the request.

Enterprise add-on

cf.waf.credential_check.password_leaked

Indicates whether the password detected in the request was previously leaked.

cf.waf.credential_check.username_and_password_leaked

Indicates whether the auth credentials detected in the request (username-password pair) were previously leaked.

Pro or above

cf.waf.credential_check.username_leaked

Indicates whether the username detected in the request was previously leaked.

Enterprise

cf.waf.credential_check.username_password_similar

Indicates whether a similar version of the username and password credentials detected in the request were previously leaked.

Enterprise

cf.waf.score

A global score from 1–99 that combines the score of each WAF attack vector into a single score.

Enterprise

cf.waf.score.class

The attack score class of the current request, based on the WAF attack score.

Business or above

cf.waf.score.rce

An attack score from 1–99 classifying the command injection or Remote Code Execution (RCE) attack vector.

Enterprise

cf.waf.score.sqli

An attack score from 1–99 classifying the SQL injection (SQLi) attack vector.

Enterprise

cf.waf.score.xss

An attack score from 1–99 classifying the cross-site scripting (XSS) attack vector.

Enterprise

cf.worker.upstream_zone

Identifies whether a request comes from a worker or not.

http.cookie

The entire cookie as a string.

http.host

The hostname used in the full request URI.

http.referer

The HTTP Referer request header, which contains the address of the web page that linked to the currently requested page.

http.request.accepted_languages

List of language tags provided in the Accept-Language HTTP request header.

http.request.body.form

The HTTP request body of a form represented as a Map (or associative array).

Enterprise

http.request.body.form.names

The names of the form fields in an HTTP request.

Enterprise

http.request.body.form.values

The values of the form fields in an HTTP request.

Enterprise

http.request.body.mime

The MIME type of the request detected from the request body.

http.request.body.multipart

A Map (or associative array) representation of multipart names to multipart values in the request body.

Enterprise

http.request.body.multipart.content_dispositions

List of Content-Disposition headers for each part in the multipart body.

Enterprise

http.request.body.multipart.content_transfer_encodings

List of Content-Transfer-Encoding headers for each part in the multipart body.

Enterprise

…(内容过长已截断)

------
导航页打开网址