docs(bots): document JA3/JA4 unavailability on O2O traffic#31979
Open
zeinjaber wants to merge 1 commit into
Open
docs(bots): document JA3/JA4 unavailability on O2O traffic#31979zeinjaber wants to merge 1 commit into
zeinjaber wants to merge 1 commit into
Conversation
zeinjaber
requested review from
a team,
elithrar,
jinhee-c-lee and
marinaelmore
as code owners
Contributor
Review✅ No issues found in commit Code ReviewThis code review is in beta and may not always be helpful — use your judgment. No code review issues found. ConventionsNo convention issues found. Style Guide ReviewNo style-guide issues found. CommandsOnly codeowners can run commands. Post a comment with the command to trigger it.
|
Contributor
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
Closes DEE-3696
zeinjaber
force-pushed
the
docs/DEE-3696-ja3-ja4-o2o-limitation
branch
from
49f05d9 to
5ea74da
Compare
Contributor
|
Preview URL: https://5ea74daf.preview.developers.cloudflare.com Files with changes (up to 15) |
|
|
||
| ### Orange-to-orange (O2O) traffic | ||
|
|
||
| When traffic routes through an O2O setup — where one Cloudflare zone proxies requests to another — JA3 and JA4 fingerprints may be unavailable. Cloudflare sees only the inner Cloudflare-to-Cloudflare TLS session on the receiving zone, not the original client handshake, so no fingerprint can be derived. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a Limitations section to the JA3/JA4 fingerprint page with a subsection explaining that fingerprints are unavailable on orange-to-orange (O2O) traffic, and recommending alternative bot fields.
Why
When a Cloudflare zone proxies requests to another Cloudflare zone via O2O, the receiving zone sees only the inner Cloudflare-to-Cloudflare TLS session — not the original client handshake — so no JA3/JA4 fingerprint can be derived. Customers using JA3/JA4-based bot rules on O2O-receiving zones see missing fingerprints with no explanation in the docs, leading to confusion and support escalations.
Files changed
src/content/docs/bots/additional-configurations/ja3-ja4-fingerprint/index.mdx— new## Limitationssection with O2O subsection (+9 lines)How to verify
Navigate to /bots/additional-configurations/ja3-ja4-fingerprint/ and confirm the Limitations section appears at the bottom with the O2O explanation and alternative field recommendations.
Closes DEE-3696