Cloudflare Application Security flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Same-origin policy

A browser rule that permits scripts to read responses only when scheme, host, and port all match the page origin. Cross-origin reads are blocked unless CORS headers explicitly allow them.

CORS preflight

An OPTIONS request the browser sends before certain cross-origin requests to confirm the server allows the method and headers. The server answers with Access-Control-Allow-* headers.

Strict-Transport-Security

A response header instructing browsers to use HTTPS only for the domain for a set max-age. It prevents protocol downgrade and cookie leakage over plaintext connections.

Content-Security-Policy

A header that restricts which sources may load scripts, styles, and frames. It mitigates XSS by blocking inline and unauthorized external script execution.

Reflected XSS

An attack where injected script is echoed from the request into the response and executes in the victim browser. Output encoding and CSP are primary defenses.

Stored XSS

Injected script is saved server-side, such as in a comment field, and served to later visitors. Input validation and contextual output encoding prevent it.

CSRF token

A per-session unpredictable value embedded in forms and validated server-side. Cross-site requests lack the token and are rejected even when cookies are sent.

SQL injection

Injection of SQL syntax through unsanitized input so the query executes attacker logic. Parameterized queries separate code from data and prevent it.

Volumetric DDoS

An attack that floods a target with high bandwidth traffic, measured in bits per second. Anycast distribution and upstream scrubbing absorb it before it reaches the origin.

Protocol DDoS

An attack consuming connection state or packet-processing capacity, measured in packets per second. SYN floods are a common form, countered with SYN cookies at the edge.

Application-layer DDoS

A flood of seemingly valid HTTP requests measured in requests per second. It is mitigated with rate limiting, caching, and WAF rules rather than bandwidth scrubbing.

Anycast

Announcing one IP address from many edge locations so traffic routes to the nearest. During an attack, the flood is spread across locations instead of one datacenter.

SYN flood

An attack sending many TCP SYN packets without completing handshakes, exhausting connection tables. SYN cookies and edge termination protect the origin server.

DNS amplification

A reflection attack using spoofed source IPs and open resolvers to send large DNS responses to a victim. The amplification factor is response size divided by request size.

Rate limiting

A rule capping requests per client per time interval. It is the primary control against HTTP floods and brute-force bursts reaching the origin.

Origin IP exposure

When the origin server address is publicly known, attackers can bypass edge protection and hit it directly. Firewalling the origin to edge ranges mitigates this.

WAF rule phases

Ordered evaluation stages where managed rules run first, then custom rules, then rate limiting. The first terminating action stops further rule evaluation.

OWASP Core Ruleset

A managed WAF ruleset using anomaly scoring. Each matched rule adds to a score, and requests exceeding the threshold are blocked.

Paranoia level

A sensitivity setting for managed rules. Higher levels add stricter rules and catch more attacks but raise false positives on legitimate traffic.

WAF skip action

A rule action that exempts matching requests from later rules in the evaluation chain. It is used to prevent false positives on trusted endpoints.

WAF custom rule expression

A logical condition combining request fields with and, or, and not. Example: http.request.uri.path contains "/admin" and ip.src ne 203.0.113.7.

Managed challenge action

A WAF action that presents a challenge the client can pass without user interaction when possible. It filters automated clients while allowing most real users.

Log-only WAF mode

A configuration that records rule matches without blocking requests. It measures false-positive impact before switching rules to enforcement.

WAF body inspection limit

A configurable maximum request body size evaluated by body-matching rules. Content beyond the limit is not inspected, so large payloads can evade body rules.

Bot score

A value from 1 to 99 where lower numbers indicate likely automation and higher numbers indicate likely human traffic. Rules act on score thresholds.

JA3 fingerprint

A hash derived from TLS client hello parameters such as cipher suites and extensions. Matching fingerprints identify tools and clients independent of user agent.

Verified bots

Automated clients validated as known legitimate crawlers or services. They are allowlisted by category so they are not blocked with malicious automation.

Static resource protection

A setting that applies bot checks to cached assets such as images and scripts. Without it, automated requests for static files bypass bot mitigation.

JavaScript detection

A small script served to the client to confirm a real browser environment. Headless and scripted clients often fail, raising their automation signal.

Heuristic bot detection

Detection based on anomalies such as high request rates from one IP or mismatched user agent and header patterns. It complements fingerprint and reputation signals.

Credential stuffing

Automated login attempts using leaked username and password pairs across many accounts. Bot management and rate limiting at the edge reduce its success.