Getting a captcha check for website address “https://domain/known/apple-app-site-association” even though we have defined a WAF rule to skip and a general rule to “secutiy essentially turned off”. We do Geo block, my understanding is those two rules should negate this.
What steps have you taken to resolve the issue?
Generated a WAF rule and placed as first to skip request to full url
Generated a general rule to disable security, cloudflare 3rd party tools and other items to full URL
What is the current SSL/TLS setting?
Full
What are the steps to reproduce the issue?
Attempting to access direct path from blocked Geo locations causes a captcha.
You should be able to see the challenged or blocked event under the Security tab → Events at Cloudflare dashboard for your zone and know exactly which security option was triggered.
Once you find them, click on a particular one to find more details about it (user-agent, IP, HTTP version …). If yes, could you share some details which service was triggered that blocked you?
I looked through the security events and it is saying that the test are being blocked by the custom GEO Location rule even though it is last on the list and exclusions provided for URL Full.
At first sight, in your rule from the bove screenshot you use contains while using a wildcard (apex) * star symbol. Change it to wildcard instead of contains if you plan to continue with * symbol in the input field.
In your 2nd rule, change URI Full to URI Path and make sure it’s apple-app-site-association in the input field, so it’ll match both HTTP and HTTPS and www and non-www and at the end someone could add ending slash / like apple-app-site-association/ and not being blocked. Some browsers add the ending slash /, in others you don’t see it. Wonder how it’s handled on the origin web host
I have made those changes and am working on testing. Would it be better to add the path for the second firewall rule instead of “apple-app-site-association”?
It is a single item in this directory we want to skip the WAF rule. I have been watching and the Custom Skip rule is working but it still goes to Custom Rule 2 which is the GEO block even though we have “Skip all custom rules” checked.
