WAF Hmac custom rule blocks valid requests

Website, Application, Performance Security
1

What is the name of the domain?

dev.media.otiumz.com

What is the error message?

403 request blocked

What is the issue you’re encountering

valid requests are blocked by WAF Hmac custom rule

What steps have you taken to resolve the issue?

retry the request, sometimes it works, sometimes it doesn’t. I looked at security events, it doesn’t tell the specific reason why it fails

here is the rule details:

(http.host eq “dev.media.otiumz.com” and not is_timed_hmac_valid_v0(“secretKey”, http.request.uri, 10800, http.request.timestamp.sec, 8))

What is the current SSL/TLS setting?

Full

2

At first sight, may I ask if you’re using Advanced Certificate Manager for such deep-level sub-domain case? :thinking: Universal SSL doesn’t cover that and you’d have to purchase ACM:

Below article is the source where you’ve went to cross-check and used as a reference?

3

Hi,

This subdomain points to R2 bucket, so advanced certificates don’t apply in this case, as stated in the url you provided:
“Advanced certificates are not used with [Cloudflare Pages] nor [R2] due to [certificate prioritization]. Both Pages and R2 custom domains use Cloudflare for SaaS certificates.”

Rule logic and request data are correct, If I send same request, sometimes it works, sometimes it doesn’t.

Thank you

4

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.