What is the name of the domain?
busynippers.com.au
What is the issue you’re encountering
server side the page is rendered correctly, when received in the browser the FORM tag has been stripped. If i turn off the proxy in cloudflare the FORM tag is no longer stripped.
What steps have you taken to resolve the issue?
WAF rule has been introduced to skip rules for that matching URL path, firewall events show that this rule is being applied correctly. bot fight mode is disabled. cache developer mode does not change the behaviour. HTTP headers on the response dont show any useful infromation. page is set to no-cache as its part of a ERP application. there are no application page rules for this application (only HTTPS rewrite and SSL)
What are the steps to reproduce the issue?
the form tag is not always stripped, however the behaviour is deterministic. When it is stripped it is always stripped for a given URL. Given that this is in a private application, access is not available to the public.
screenshot shows where the FORM tag should be in a copy of the dev version (not cached by cloudflare and hence not affected)
Screenshot of the error
