You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/api-shield/security/jwt-validation/index.mdx
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,6 @@ import {
14
14
DashButton,
15
15
} from"~/components";
16
16
17
-
{/* prettier-ignore */}
18
17
<GlossaryTooltipterm="JSON web token (JWT)">JSON web tokens (JWT)</GlossaryTooltip> are often used as part of an authentication component on many web applications today. Since JWTs are crucial to identifying users and their access, ensuring the token’s integrity is important.
19
18
20
19
API Shield’s JWT validation stops JWT replay attacks and JWT tampering by cryptographically verifying incoming JWTs before they are passed to your API origin. JWT validation will also stop requests with expired tokens or tokens that are not yet valid.
@@ -126,7 +125,7 @@ API Shield will verify JSON Web Tokens regardless of whether or not they have th
126
125
127
126
### Ignore `OPTIONS` pre-flight CORS requests
128
127
129
-
Due to cross-origin resource sharing (CORS) security, web browsers will send "pre-flight" requests using the `OPTIONS` verb to API endpoints before sending a `GET` (or other verb) request. By definition, `OPTIONS` requests do not include headers or cookies and are anonymous.
128
+
Due to cross-origin resource sharing (CORS) security, web browsers will send "pre-flight" requests using the `OPTIONS` verb to API endpoints before sending a `GET` (or other verb) request. By definition, `OPTIONS` requests do not include headers or cookies and are anonymous.
130
129
131
130
If you expect web browsers to be valid clients of your API, and to prevent blocking `OPTIONS` requests from those browsers, Cloudflare recommends adding `or http.request.method eq "OPTIONS"` to your JWT validation rules.
132
131
@@ -137,6 +136,7 @@ If you expect web browsers to be valid clients of your API, and to prevent block
137
136
JWT validation is available for all API Shield customers. Enterprise customers who have not purchased API Shield can preview [API Shield as a non-contract service](https://dash.cloudflare.com/?to=/:account/:zone/security/api-shield) in the Cloudflare dashboard or by contacting your account team.
Copy file name to clipboardExpand all lines: src/content/docs/api-shield/security/schema-validation/index.mdx
+6-7Lines changed: 6 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,6 @@ You can migrate to Schema validation 2.0 manually by uploading your schemas to t
29
29
30
30
## Process
31
31
32
-
{/* prettier-ignore */}
33
32
<GlossaryTooltipterm="API endpoint">Endpoints</GlossaryTooltip> must be added to [Endpoint Management](/api-shield/management-and-monitoring/endpoint-management/) for Schema validation to protect them. Uploading a schema via the Cloudflare dashboard will automatically add endpoints, or you can manually add them from [API Discovery](/api-shield/security/api-discovery/).
34
33
35
34
If you are uploading a schema via the API or Terraform, you must parse the schema and add your endpoints manually.
@@ -434,12 +433,12 @@ Schema validation inspects request bodies up to a maximum size that depends on y
434
433
435
434
The default body size limits are:
436
435
437
-
| Plan | Default body size limit |
438
-
| --- | --- |
439
-
| Free | 1 KB |
440
-
| Pro | 8 KB |
441
-
| Business | 8 KB |
442
-
| Enterprise | 128 KB |
436
+
| Plan | Default body size limit |
437
+
| ----------|----------------------- |
438
+
| Free | 1 KB|
439
+
| Pro | 8 KB|
440
+
| Business | 8 KB|
441
+
| Enterprise | 128 KB |
443
442
444
443
:::note
445
444
This limit is separate from the [WAF maximum body inspection size](/waf/managed-rules/#maximum-body-size), which controls how much of the request payload the WAF scans. Increasing one does not affect the other.
- Called by the system when a scheduled alarm time is reached.
101
-
102
97
- The `alarm()` handler has guaranteed at-least-once execution and will be retried upon failure using exponential backoff, starting at two second delays for up to six retries. Retries will be performed if the method fails with an uncaught exception.
103
-
104
98
- This method can be `async`.
105
-
106
99
- Refer to [Alarms](/durable-objects/api/alarms/) for more information.
107
100
108
101
#### Parameters
@@ -132,10 +125,7 @@ export class MyDurableObject extends DurableObject<Env> {
: <Typetext="void" /> | <Typetext="Promise<void>" />- Called by the system
178
165
when a WebSocket connection is closed.
179
166
- With the [`web_socket_auto_reply_to_close`](/workers/configuration/compatibility-flags/#websocket-auto-reply-to-close) compatibility flag (enabled by default on compatibility dates on or after `2026-04-07`), the runtime automatically sends a reciprocal Close frame and transitions `readyState` to `CLOSED` before this handler is called. You do not need to call `ws.close()` — but doing so is safe (the call is silently ignored).
@@ -209,9 +196,7 @@ export class MyDurableObject extends DurableObject<Env> {
0 commit comments