Is user agent field case-sensitive?

Pretty much like the title mentioned, user agent Field on Firewall Rules, does the input Value case-sensitive?

Thank you.

It is, but there is a lower() function which you can use.

2 Likes

Would you kindly tell me how to use that function?

The search has more on that, https://community.cloudflare.com/search?q=lower

2 Likes

Oh, it actually is documented, who would have thought :smile:

3 Likes

The first link of that actually points to an article which was incidentally posted only yesterday and which provides a concrete example

I try this:

or (lower(http.user_agent) contains “semrushbot”)
or (lower(http.user_agent) contains “ahrefsbot”)
or (lower(http.user_agent) contains “python”)

It works.

Do you know where should I put the lower function if my expression is like this?

(not http.user_agent contains “googlebot”)
or (not http.user_agent contains “chrome-lighthouse”)
or (not http.user_agent contains “qwantify”)
or (not http.user_agent contains “duckduckgo”)

I tried a few way and got error messages. Sorry, newbie here.

Same place, around the field name. That’s what you want to lower-case.

I try this to JS-challenge user agent that is not contains Googlebot…

(not lower(http.user_agent) contains “googlebot”)
or (not lower(http.user_agent) contains “mediapartners-google”)
or (not lower(http.user_agent) contains “adsbot-google”)

…but still Googlebot got challenged

The operator is incorrect.

Let’s say the full user agent of the traffic is Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html). (not lower(http.user_agent) contains “googlebot”) will return False, but (not lower(http.user_agent) contains “mediapartners-google”) and (not lower(http.user_agent) contains “adsbot-google”) expressions return True, so the traffic gets JS challenged.

Switch it to and operator instead, so when either one of the sub-expressions return False, the whole expression will return False.

2 Likes

If you want to test a NEGATIVE for any of the conditions then you should use AND. If you want to use a POSITIVE for any of the conditions then you should use OR.

Also, are you testing for Googlebot only? There is the cf.client.bot field you can test - TRUE will be a known good bot - the list is here Known issues and FAQ · Cloudflare Firewall Rules docs

If you then want to block other bots you could start with the new Bot Fight Mode just release, plus this field and perhaps then catching anything that goes through using a firewall rule “if lower(agent) contains “botname” or…” and then block or challenge.

2 Likes

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.