Cloudflare Application Security case studies
Cloudflare Application Security · Put your knowledge to work in context.
The Cloudflare Application Security certification is an independent study credential for security engineers, SOC analysts, DevOps practitioners, and web platform owners who need to defend internet-facing applications. It is not affiliated with, endorsed by, or sponsored by Cloudflare, Inc.; this page is an independent preparation guide. The Cloudflare Application Security case studies are 5 cases and about 4,508 words.
1A Dangling CNAME and a Domain-Wide Session Cookie
Lumen Freight runs its customer portal at app.lumenfreight.com behind Cloudflare. The session cookie is issued as lf session=<opaque ; Domain=.lumenfreight.com; Path=/; Secure; HttpOnly; SameSite=Lax with a 30-day lifetime.
878 words, about 4 min2Cache-Busting HTTP Flood on a Black Friday Search Endpoint
At 12:04 UTC on Black Friday, an online retailer's storefront, proxied by Cloudflare, drops from an 88% cache hit ratio to 6%. The attack targets GET /api/v2/search?q=<random 12 chars & cb=<random at roughly 480,000 requests per second.
899 words, about 4 min3Managed Rules Straight to Block: Triaging False Positives on a JSON API
An API-first SaaS runs api.example.com (REST plus a single /v1/graphql endpoint) and a React SPA. To close findings from a pen test, the platform team enables the Cloudflare OWASP Core Ruleset and a new custom rule set, both set to Block, in one change window with no staging period.
899 words, about 4 min4Residential-Proxy Credential Stuffing Against a Login API
A retail bank's login API, POST /api/v1/auth/login , takes JSON {username, password} and sits behind Cloudflare with Bot Management Enterprise. Over nine days the bank sees roughly 40,000 login attempts per day across about 18,000 distinct usernames taken from an old breach dump.
929 words, about 5 min5Path Normalisation Differentials: /admin Bypass and Cache Deception
A payments company protects portal.example.com with Cloudflare. The origin is a Spring Boot application behind an AWS ALB, and /admin is the internal console.
903 words, about 5 min