eCDN Custom Rules

Use custom rules to control incoming traffic by setting up security policies based on request parameters. With custom rules, you have complete control over the rule expression, the allowed request field types, and the rule actions. This flexibility helps you create expressions that match your traffic needs. To create a custom rule in Business Manager, see Create a Custom Rule for an eCDN Zone in Salesforce Help.

The fields and operators supported in the rule expression are now consistent with what is offered with rate limiting rules. For more information, refer to Rule Expression in the eCDN Rate Limiting Rules guide.

The following rule actions are supported in the actions array:

• block - Denies access to the requested site.

• js_challenge - The client that made the request must pass a JavaScript Challenge before proceeding.

• legacy_captcha - The client that made the request must pass an interactive challenge.

  Legacy captcha still exist through the API. However, Salesforce recommends selecting the managed challenge response for a better user experience.

• managed_challenge - Depending on the characteristics of the request, the appropriate type of challenge is presented to the client.

• log - Logs matching requests.

The following skip actions are also supported in the actions array:

• skip_custom_rules - Skips all remaining custom rules (meaning custom rules with a lower priority are not evaluated).
• skip_security_level - Skips Security Level.
• skip_rate_limiting_rules - Skips rate limiting rules. See eCDN Rate Limiting Rules for related documentation.
• skip_wafv2 - Skips WAFv2 managed rules. For additional information, see eCDN WAFv2.

Custom rules are evaluated in the order they are listed in the response body. If a custom rule’s expression is matched, the action is executed.

• The managed_challenge, js_challenge, legacy_captcha, block, and skip_custom_rules actions stop further custom rule evaluation and no other rules in the ruleset are evaluated.
• The skip_security_level, skip_rate_limiting_rules, skip_wafv2, and log actions do not stop custom rule evaluation.

When creating or updating a custom rule, users can provide a position attribute in the request body to insert the rule at a certain relative position in the ruleset. If the position is not provided during rule creation, the rule is added to the end of the ruleset by default. See the following usage examples:

This endpoint creates a custom rule in the specified zone.

• The description, expression, and actions attributes are required.
• The enabled and position attributes are optional.
• Refer to the Validation Overview section for more information on input validation

Response body contains the custom rule that was created.

This endpoint returns all of the custom rules in the specified zone. If no custom rules exist, a 404 Not Found response is returned.

Response body contains all of the existing custom rules in the specified zone.

This endpoint returns the requested custom rule. If the requested rule does not exist, a 404 Not Found response is returned.

Response body contains the requested custom rule.

This endpoint updates the requested custom rule. If the requested rule does not exist, a 404 Not Found response is returned.

• The user must provide at least one of the following attributes in the request body: description, expression, actions, enabled, or position.

Response body contains the requested rule.

This endpoint updates the order of all existing custom rules. The user provides an array of ruleIds that represents the new rule order. The array must contain exactly all of the existing custom rule ruleIds.

Response body contains all of the existing custom rules in updated rule order.

This endpoint deletes the requested custom rule. If the requested rule does not exist, a 404 Not Found response is returned.

• How do I construct the rule expression?
  • See the Cloudflare documentation for more information regarding constructing rule expressions.