Scenario
An origin trusts CF Access headers and later one static-like route starts reaching it without the expected identity context.
Cloudflare Access protects the app generally and one cached path reaches the origin without identity headers because a bypass cache rule short-circuits the Access app on that route
Most requests carry Access identity data, yet one path arrives anonymous because an edge rule changed the processing order on that cacheable route.
What to check first
- Identify the primary failure signal in the WAF / AppSec scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Audit edge processing order between Access and cache/bypass rules before weakening origin auth.
Questions worth viewing together
Community-field security problem inspired by Cloudflare community patterns where cache rules bypassed Access identity handling on one route. Identity products at the edge can be bypassed accidentally by unrelated cache rule changes.
Teams often blame origin middleware when the identity headers were never added on that route.
Edge rule precedence becomes part of the security boundary when origins trust injected identity headers.
Similar cases seen in the field