From 7a023ad3bce26615e7760c95685ec520262d7f79 Mon Sep 17 00:00:00 2001 From: Max Phillips Date: Thu, 14 Aug 2025 16:33:29 -0500 Subject: [PATCH 001/202] Add CAC section --- .../cloudflare-one/policies/gateway/http-policies/index.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx index 17a374708bc9e9d..b9eb0b1eeb79d9b 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx @@ -401,6 +401,10 @@ Gateway matches HTTP traffic against the following selectors, or criteria: When using Terraform to create a policy with the [Do Not Inspect](#do-not-inspect) action, you must use the `app.hosts_ids` and `app.supports_ids` selectors. For example, to create a Do Not Inspect policy for Google Cloud Platform traffic, create a policy with both `any(app.hosts_ids[*] in {1245})` and `any(app.supports_ids[*] in {1245})`. ::: +#### Cloud App Control + +When using the _is_ operator with the _Application_ selector, you can use Cloudflare App Control to choose specific actions and operations to match application traffic to. Controls include **Application Controls**, which group multiple user actions together, or **Operations**, which involves all supported API-level actions for an application. + ### Content Categories Date: Mon, 18 Aug 2025 16:55:48 -0500 Subject: [PATCH 002/202] Improve wording and add example --- .../policies/gateway/http-policies/index.mdx | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx index b9eb0b1eeb79d9b..3bd7bb8af88e66f 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx @@ -403,7 +403,13 @@ When using Terraform to create a policy with the [Do Not Inspect](#do-not-inspec #### Cloud App Control -When using the _is_ operator with the _Application_ selector, you can use Cloudflare App Control to choose specific actions and operations to match application traffic to. Controls include **Application Controls**, which group multiple user actions together, or **Operations**, which involves all supported API-level actions for an application. +When using the _is_ operator with the _Application_ selector, you can use Cloud App Control to choose specific actions and operations to match application traffic. For example, you can block file uploads to ChatGPT without blocking all ChatGPT traffic: + +| Selector | Operator | Value | Controls | Action | +| ----------- | -------- | --------- | -------- | ------ | +| Application | is | _ChatGPT_ | _Upload_ | Block | + +You can match traffic based on **Application Controls**, which group multiple user actions together, or **Operations**, which allow for granular control of supported API-level actions for an application. ### Content Categories From 112ad561a9c2761c818870da4373c2bf0679704c Mon Sep 17 00:00:00 2001 From: Max Phillips Date: Fri, 22 Aug 2025 14:56:59 -0500 Subject: [PATCH 003/202] Add supported AI app tables --- .../gateway/application-app-types.mdx | 76 ++++++++++++++++++- .../policies/gateway/http-policies/index.mdx | 2 +- 2 files changed, 76 insertions(+), 2 deletions(-) diff --git a/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx b/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx index 10be6ed5fa661d3..cdb8d790d59936f 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx @@ -5,7 +5,7 @@ sidebar: order: 9 --- -import { GlossaryDefinition, GlossaryTooltip } from "~/components"; +import { GlossaryDefinition, GlossaryTooltip, Details } from "~/components"; Gateway allows you to create DNS, Network, and HTTP policies based on applications and app types. You can select individual applications or groups of app types to filter specific traffic on your network. @@ -45,6 +45,80 @@ Gateway sorts applications into the following app type groups: | Video Streaming | Video streaming applications | | [Do Not Inspect](#do-not-inspect-applications) | Applications incompatible with the TLS certificate required by the [Gateway proxy](/cloudflare-one/policies/gateway/proxy/) | +## Application controls + +With [Cloud App Control](/cloudflare-one/policies/gateway/http-policies/#cloud-app-control), you can choose specific actions and operations to match application traffic. Supported applications and operations include: + +
+ +| Operations group | Operations group ID | Operation name | Operation ID | Application Controls group | Application control ID | DLP content | +| ---------------- | ------------------- | ------------------ | ------------ | -------------------------- | ---------------------- | ----------- | +| Chat | `1650` | SendPrompt | `8004` | Prompt | `1652` | ✅ | +| Chat | `1650` | UploadFile | `8008` | Upload | `1653` | ❌ | +| Chat | `1650` | UploadFilePayload | `8013` | Upload | `1653` | ✅ | +| Chat | `1650` | ShareResponse | `8006` | Share | `1654` | ❌ | +| Chat | `1650` | ShareCanvas | `8007` | Share | `1654` | ❌ | +| Chat | `1650` | TranscribeVoice | `8011` | Voice | `1655` | ❌ | +| Chat | `1650` | EnableVoiceMode | `8003` | Voice | `1655` | ❌ | +| Settings | `1651` | AllowTraining | `8009` | | | ❌ | +| Settings | `1651` | AllowVoiceTraining | `8010` | | | ❌ | +| Settings | `1651` | AllowVideoTraining | `8016` | | | ❌ | +| Settings | `1651` | ExportData | `8020` | | | ❌ | + +
+ +
+ +| Operations group | Operations group ID | Operation name | Operation ID | Application Controls group | Application control ID | DLP content | +| ---------------- | ------------------- | ----------------- | ------------ | -------------------------- | ---------------------- | ----------- | +| Chat | `1656` | SendPrompt | `8021` | Prompt | `1657` | ✅ | +| Chat | `1656` | UploadFile | `8022` | Upload | `1658` | ❌ | +| Chat | `1656` | UploadFilePayload | `8023` | Upload | `1658` | ✅ | +| Chat | `1656` | TranscribeVoice | `8025` | Voice | `1659` | ❌ | + +
+ +
+ +| Operations group | Operations group ID | Operation name | Operation ID | Application Controls group | Application control ID | DLP content | +| ---------------- | ------------------- | ---------------------- | ------------ | -------------------------- | ---------------------- | ----------- | +| Chat | `2596` | SendPrompt | `11947` | Prompt | `2598` | ✅ | +| Chat | `2596` | ClarifyingPrompt | `11951` | Prompt | `2598` | ✅ | +| Chat | `2596` | CreateUploadUrl | `11948` | Upload | `2599` | ❌ | +| Chat | `2596` | UploadFile | `11955` | Upload | `2599` | ✅ | +| Settings | `2597` | UploadOrganizationFile | `11950` | Upload | `2599` | ❌ | +| Chat | `2596` | ShareChat | `11952` | Share | `2600` | ❌ | +| Chat | `2596` | VoiceTranscription | `11953` | Voice | `2601` | ❌ | +| Chat | `2596` | ExportChat | `11949` | | | ❌ | +| Chat | `2596` | DeleteThread | `11954` | | | ❌ | +| Settings | `2597` | DeleteOrganizationFile | `11956` | | | ❌ | + +
+ +
+ +| Operations group | Operations group ID | Operation name | Operation ID | Application Controls group | Application control ID | DLP content | +| ---------------- | ------------------- | --------------------- | ------------ | -------------------------- | ---------------------- | ----------- | +| Chat | `2126` | SendPrompt | `10048` | Prompt | `2127` | ✅ | +| Chat | `2126` | PromptCompletion | `10050` | Prompt | `2127` | ✅ | +| Chat | `2126` | RetryPromptCompletion | `10040` | Prompt | `2127` | ✅ | +| Chat | `2126` | UploadFile | `10039` | Upload | `2128` | ✅ | +| Chat | `2126` | ConvertDocument | `10041` | Upload | `2128` | ✅ | +| Chat | `2126` | ShareConversation | `10043` | Share | `2129` | ❌ | +| Chat | `2126` | GetShares | `10052` | Share | `2129` | ❌ | +| Chat | `2126` | CreateConversation | `10038` | | | ❌ | +| Chat | `2126` | GetConversation | `10046` | | | ❌ | +| Chat | `2126` | UpdateConversation | `10047` | | | ❌ | +| Chat | `2126` | DeleteConversation | `10045` | | | ❌ | +| Settings | `2125` | UpdateAccount | `10036` | | | ❌ | +| Settings | `2125` | InitiateDataExport | `10037` | | | ❌ | +| Chat | `2126` | GiveFeedback | `10042` | | | ❌ | +| Chat | `2126` | SetConversationTitle | `10044` | | | ❌ | +| Settings | `2125` | GetOrganisation | `10049` | | | ❌ | +| Chat | `2126` | GetFilePreview | `10051` | | | ❌ | + +
+ ## Usage ### Overlapping hostnames diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx index 3bd7bb8af88e66f..ae0a7345f2ec7ef 100644 --- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx +++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx @@ -409,7 +409,7 @@ When using the _is_ operator with the _Application_ selector, you can use Cloud | ----------- | -------- | --------- | -------- | ------ | | Application | is | _ChatGPT_ | _Upload_ | Block | -You can match traffic based on **Application Controls**, which group multiple user actions together, or **Operations**, which allow for granular control of supported API-level actions for an application. +You can match traffic based on **Application Controls**, which group multiple user actions together, or **Operations**, which allow for granular control of supported API-level actions for an application. For a list of supported granular controls, refer to [Application controls](/cloudflare-one/policies/gateway/application-app-types/#application-controls). ### Content Categories From 3f84e01f7751212e238460507963c176b98cae97 Mon Sep 17 00:00:00 2001 From: Max Phillips Date: Fri, 22 Aug 2025 17:52:07 -0500 Subject: [PATCH 004/202] Add AI prompt topic section --- .../detection-entries.mdx | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/policies/data-loss-prevention/detection-entries.mdx b/src/content/docs/cloudflare-one/policies/data-loss-prevention/detection-entries.mdx index bcce03e21b9727b..7e8a53859d4d0f3 100644 --- a/src/content/docs/cloudflare-one/policies/data-loss-prevention/detection-entries.mdx +++ b/src/content/docs/cloudflare-one/policies/data-loss-prevention/detection-entries.mdx @@ -7,7 +7,7 @@ sidebar: import { Details } from "~/components"; -Cloudflare DLP can scan your web traffic and SaaS applications for specific data defined in custom detection entries. Detection entries allow you to define custom data patterns for DLP to detect using [DLP profiles](/cloudflare-one/policies/data-loss-prevention/dlp-profiles/). Detection entries include custom [datasets](#datasets) with defined data and [document entries](#documents) with example fingerprints. +Cloudflare DLP can scan your web traffic and SaaS applications for specific data defined in custom detection entries. Detection entries allow you to define custom data patterns for DLP to detect using [DLP profiles](/cloudflare-one/policies/data-loss-prevention/dlp-profiles/). Detection entries include custom [datasets](#datasets) with defined data, [document entries](#documents) with example fingerprints, and [AI prompt topics](#ai-prompt-topics). You can configure sensitive data to be hashed before reaching Cloudflare and redacted from matches in [payload logs](/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options/#log-the-payload-of-matched-rules). @@ -132,3 +132,20 @@ Uploaded document entries are read-only. To update a document entry, you must up 5. Select **Save**. Your new document entry will replace the original document entry. If your file upload fails, DLP will still use the original document fingerprint to scan traffic until you delete the entry. + +## AI prompt topics + +DLP uses [Cloud App Control](/cloudflare-one/policies/gateway/http-policies/#cloud-app-control) to detect and categorize prompts and responses submitted to generative AI tools. Cloud App Control analyzes prompts for both content and user intent. Supported prompt topic detections include: + +| Detection entry | Description | +| ------------------------------------- | ------------------------------------------------------------------------------------------------ | +| Content: PII | Prompt contains personal information such as names, SSNs, or email addresses | +| Content: Credentials and Secrets | Prompt contains API keys, passwords, or other sensitive credentials | +| Content: Source Code | Prompt contains actual source code, code snippets, or proprietary algorithms | +| Content: Customer Data | Prompt contains customer names, projects, business activities, or confidential customer contexts | +| Content: Financial Information | Prompt contains financial numbers or confidential business data | +| Intent: PII | Prompt requests specific personal information about individuals | +| Intent: Code Abuse and Malicious Code | Prompt requests malicious code for attacks, exploits, or harmful activities | +| Intent: Jailbreak | Prompt attempts to circumvent AI security policies | + +To use an AI prompt topic, add it as an existing entry to a [custom DLP profile](/cloudflare-one/policies/data-loss-prevention/dlp-profiles/#build-a-custom-profile). From 5931a42d9aec4a38b7501e2a392f99a90ebc40e9 Mon Sep 17 00:00:00 2001 From: Max Phillips Date: Fri, 22 Aug 2025 18:14:03 -0500 Subject: [PATCH 005/202] Add logging options --- .../dlp-policies/logging-options.mdx | 41 +++++++++++++++---- 1 file changed, 32 insertions(+), 9 deletions(-) diff --git a/src/content/docs/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options.mdx b/src/content/docs/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options.mdx index 51566afc7145904..cd00769374d7624 100644 --- a/src/content/docs/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options.mdx +++ b/src/content/docs/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options.mdx @@ -5,17 +5,19 @@ sidebar: order: 2 --- -Data Loss Prevention allows you to capture, store, and view the data that triggered a specific DLP policy for use as forensic evidence. Users on all plans can [log the payload](#log-the-payload-of-matched-rules) of matched HTTP requests in their Cloudflare logs. Additionally, Enterprise users can [configure a Logpush job](#send-http-requests-to-logpush-destination) to send copies of entire matched HTTP requests to storage destinations. - -## Log the payload of matched rules +Data Loss Prevention allows you to capture, store, and view the data that triggered a specific DLP policy for use as forensic evidence. Users on all plans can log the [payload](#log-the-payload-of-matched-rules) or [generative AI prompt content](#log-generative-ai-prompt-content) of matched HTTP requests in their Cloudflare logs. Additionally, Enterprise users can [configure a Logpush job](#send-http-requests-to-logpush-destination) to send copies of entire matched HTTP requests to storage destinations. The data that triggers a DLP policy is stored in the portion of the HTTP request known as the payload. Payload logging is especially useful when diagnosing the behavior of DLP policies. Since the values that triggered a rule may contain sensitive data, they are encrypted with a customer-provided public key so that only you can examine them later. The stored data will include a redacted version of the match, plus 75 bytes of additional context on both sides of the match. -### 1. Generate a key pair +## Set a DLP payload encryption public key + +Before you begin logging DLP payloads, you will need to set a DLP payload encryption public key. -Follow [these instructions](/waf/managed-rules/payload-logging/command-line/generate-key-pair/) to generate a public/private key pair in the command line. +### Generate a key pair -### 2. Upload the public key to Cloudflare +To generate a public/private key pair in the command line, refer to [these instructions](/waf/managed-rules/payload-logging/command-line/generate-key-pair/). + +### Upload the public key to Cloudflare 1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Network**. 2. In the **DLP Payload Encryption public key** field, paste your public key. @@ -25,9 +27,13 @@ Follow [these instructions](/waf/managed-rules/payload-logging/command-line/gene The matching private key is required to view logs. If you lose your private key, you will need to [generate](#1-generate-a-key-pair) and [upload](#2-upload-the-public-key-to-cloudflare) a new public key. The payload of new requests will be encrypted with the new public key. ::: -### 3. Enable payload logging for a DLP policy +## Log the payload of matched rules -You can enable payload logging for any Allow or Block HTTP policy that uses the [DLP Profile](/cloudflare-one/policies/gateway/http-policies/#dlp-profile) selector. +DLP can log the payload of matched HTTP requests in your Cloudflare logs. + +### Turn on payload logging for a DLP policy + +You can enable payload logging for any Allow or Block HTTP policy that uses the [_DLP Profile_](/cloudflare-one/policies/gateway/http-policies/#dlp-profile) selector. 1. Go to **Gateway** > **Firewall policies** > **HTTP**. 2. Edit an existing Allow or Block DLP policy, or [create a new policy](/cloudflare-one/policies/data-loss-prevention/dlp-policies/#2-create-a-dlp-policy). @@ -36,7 +42,9 @@ You can enable payload logging for any Allow or Block HTTP policy that uses the Data Loss Prevention will now store a portion of the payload for HTTP requests that match this policy. -### 4. View payload logs +### View payload logs + +To view DLP payload logs: 1. Go to **Logs** > **Gateway** > **HTTP**. 2. Go to the DLP log you are interested in reviewing and expand the row. @@ -69,6 +77,21 @@ Based on your report, DLP's machine learning will adjust its confidence in futur - DLP will redact all predefined alphanumeric characters in the log. For example, `123-45-6789` will become `XXX-XX-XXXX`. - You can define sensitive data with [Exact Data Match (EDM)](/cloudflare-one/policies/data-loss-prevention/detection-entries/#exact-data-match). EDM match logs will redact your defined strings. +## Log generative AI prompt content + +DLP can detect and log the prompt topic sent to an AI tool. + +### Turn on AI prompt content logging for a DLP policy + +You can enable payload logging for any Allow or Block HTTP policy that uses the [_Application_](/cloudflare-one/policies/gateway/http-policies/#application) selector with a supported [Cloud App Control](/cloudflare-one/policies/gateway/http-policies/#cloud-app-control) application. + +1. Go to **Gateway** > **Firewall policies** > **HTTP**. +2. Edit an existing Allow or Block DLP policy, or [create a new policy](/cloudflare-one/policies/data-loss-prevention/dlp-policies/#2-create-a-dlp-policy). +3. In the policy builder, scroll down to **Configure policy settings** and turn on **Capture generative AI prompt content in logs**. +4. Select **Save**. + +Data Loss Prevention will now store the user prompt and AI model response for requests that match this policy. + ## Send DLP forensic copies to Logpush destination :::note[Availability] From 49fd26177e8c995a054d5045b290e956bafdf438 Mon Sep 17 00:00:00 2001 From: Max Phillips Date: Fri, 22 Aug 2025 18:31:34 -0500 Subject: [PATCH 006/202] Refine logging --- .../dlp-policies/logging-options.mdx | 56 +++++++++---------- 1 file changed, 27 insertions(+), 29 deletions(-) diff --git a/src/content/docs/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options.mdx b/src/content/docs/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options.mdx index cd00769374d7624..1442f64f480d22d 100644 --- a/src/content/docs/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options.mdx +++ b/src/content/docs/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options.mdx @@ -7,7 +7,7 @@ sidebar: Data Loss Prevention allows you to capture, store, and view the data that triggered a specific DLP policy for use as forensic evidence. Users on all plans can log the [payload](#log-the-payload-of-matched-rules) or [generative AI prompt content](#log-generative-ai-prompt-content) of matched HTTP requests in their Cloudflare logs. Additionally, Enterprise users can [configure a Logpush job](#send-http-requests-to-logpush-destination) to send copies of entire matched HTTP requests to storage destinations. -The data that triggers a DLP policy is stored in the portion of the HTTP request known as the payload. Payload logging is especially useful when diagnosing the behavior of DLP policies. Since the values that triggered a rule may contain sensitive data, they are encrypted with a customer-provided public key so that only you can examine them later. The stored data will include a redacted version of the match, plus 75 bytes of additional context on both sides of the match. +The data that triggers a DLP policy is stored in the portion of the HTTP request known as the payload. Payload logging is especially useful when diagnosing the behavior of DLP policies. Since the values that triggered a rule may contain sensitive data, they are encrypted with a public key so that only you can examine them later. The stored data will include a redacted version of the match, plus 75 bytes of additional context on both sides of the match. ## Set a DLP payload encryption public key @@ -27,11 +27,11 @@ To generate a public/private key pair in the command line, refer to [these instr The matching private key is required to view logs. If you lose your private key, you will need to [generate](#1-generate-a-key-pair) and [upload](#2-upload-the-public-key-to-cloudflare) a new public key. The payload of new requests will be encrypted with the new public key. ::: -## Log the payload of matched rules +## Log matched DLP policies -DLP can log the payload of matched HTTP requests in your Cloudflare logs. +Once you set a public key, DLP can log the payload of matched HTTP requests and AI prompts in your Cloudflare logs. -### Turn on payload logging for a DLP policy +### Turn on payload logging You can enable payload logging for any Allow or Block HTTP policy that uses the [_DLP Profile_](/cloudflare-one/policies/gateway/http-policies/#dlp-profile) selector. @@ -42,7 +42,18 @@ You can enable payload logging for any Allow or Block HTTP policy that uses the Data Loss Prevention will now store a portion of the payload for HTTP requests that match this policy. -### View payload logs +### Turn on AI prompt content logging + +You can enable payload logging for any Allow or Block HTTP policy that uses the [_Application_](/cloudflare-one/policies/gateway/http-policies/#application) selector with a supported [Cloud App Control](/cloudflare-one/policies/gateway/http-policies/#cloud-app-control) application. + +1. Go to **Gateway** > **Firewall policies** > **HTTP**. +2. Edit an existing Allow or Block DLP policy, or [create a new policy](/cloudflare-one/policies/data-loss-prevention/dlp-policies/#2-create-a-dlp-policy). +3. In the policy builder, scroll down to **Configure policy settings** and turn on **Capture generative AI prompt content in logs**. +4. Select **Save**. + +Data Loss Prevention will now store the user prompt and AI model response for requests that match this policy. + +## View payload logs To view DLP payload logs: @@ -51,10 +62,12 @@ To view DLP payload logs: 3. Select **Decrypt Payload Log**. 4. Enter your private key and select **Decrypt**. -You will see the [ID of the matched DLP Profile](/api/resources/zero_trust/subresources/dlp/subresources/profiles/methods/list/) followed by the decrypted payload. +Gateway logs will display the [ID of the matched DLP Profile](/api/resources/zero_trust/subresources/dlp/subresources/profiles/methods/list/) followed by the decrypted payload. + +Additionally, if DLP detected an generative AI prompt, you can select **View prompt** to display the user prompt. :::note -Cloudflare does not store the key or the decrypted payload. +Cloudflare does not store the private key or the decrypted payload. ::: ### Report false and true positives to AI context analysis @@ -70,28 +83,6 @@ To report a DLP match payload as a false or true positive: Based on your report, DLP's machine learning will adjust its confidence in future matches for the associated profile. -### Data privacy - -- All Cloudflare logs are encrypted at rest. Encrypting the payload content adds a second layer of encryption for the matched values that triggered a DLP rule. -- Cloudflare cannot decrypt encrypted payloads, since this operation requires your private key. Cloudflare staff will never ask for the private key. -- DLP will redact all predefined alphanumeric characters in the log. For example, `123-45-6789` will become `XXX-XX-XXXX`. - - You can define sensitive data with [Exact Data Match (EDM)](/cloudflare-one/policies/data-loss-prevention/detection-entries/#exact-data-match). EDM match logs will redact your defined strings. - -## Log generative AI prompt content - -DLP can detect and log the prompt topic sent to an AI tool. - -### Turn on AI prompt content logging for a DLP policy - -You can enable payload logging for any Allow or Block HTTP policy that uses the [_Application_](/cloudflare-one/policies/gateway/http-policies/#application) selector with a supported [Cloud App Control](/cloudflare-one/policies/gateway/http-policies/#cloud-app-control) application. - -1. Go to **Gateway** > **Firewall policies** > **HTTP**. -2. Edit an existing Allow or Block DLP policy, or [create a new policy](/cloudflare-one/policies/data-loss-prevention/dlp-policies/#2-create-a-dlp-policy). -3. In the policy builder, scroll down to **Configure policy settings** and turn on **Capture generative AI prompt content in logs**. -4. Select **Save**. - -Data Loss Prevention will now store the user prompt and AI model response for requests that match this policy. - ## Send DLP forensic copies to Logpush destination :::note[Availability] @@ -116,3 +107,10 @@ To set up the DLP Forensic Copy Logpush job: DLP will now send a copy of HTTP requests that match this policy to your Logpush destination. Logpush supports up to four DLP Forensic Copy Logpush jobs per account. By default, Gateway will send all matched HTTP requests to your configured DLP Forensic Copy jobs. To send specific policy matches to specific jobs, configure [Log filters](/logs/logpush/logpush-job/filters/). If the request contains an archive file, DLP will only send up to 100 MB of uncompressed content to your configured storage. + +## Data privacy + +- All Cloudflare logs are encrypted at rest. Encrypting the payload content adds a second layer of encryption for the matched values that triggered a DLP rule. +- Cloudflare cannot decrypt encrypted payloads, since this operation requires your private key. Cloudflare staff will never ask for the private key. +- DLP will redact all predefined alphanumeric characters in the log. For example, `123-45-6789` will become `XXX-XX-XXXX`. + - You can define sensitive data with [Exact Data Match (EDM)](/cloudflare-one/policies/data-loss-prevention/detection-entries/#exact-data-match). EDM match logs will redact your defined strings. From fdba5b1307e606399687a32f89d0abde86447898 Mon Sep 17 00:00:00 2001 From: Kody Jackson Date: Thu, 14 Aug 2025 14:41:02 -0500 Subject: [PATCH 007/202] [Changelog] Add lastUpdated from changelog entry date (#24423) --- src/components/overrides/Head.astro | 24 +++++++++++++++--------- src/pages/changelog/[...slug].astro | 3 ++- 2 files changed, 17 insertions(+), 10 deletions(-) diff --git a/src/components/overrides/Head.astro b/src/components/overrides/Head.astro index fa44c498bb54d09..870214beb093d5c 100644 --- a/src/components/overrides/Head.astro +++ b/src/components/overrides/Head.astro @@ -35,26 +35,28 @@ if (currentSection) { let product = await getEntry("products", currentSection); // if entry for changelog, grab the first product value (which corresponds to the folder the entry is in) and use as the primary "product" if (currentSection === "changelog") { - const products = frontmatter.products + const products = frontmatter.products; if (products) { product = await getEntry("products", products[0]); } } if (product) { - let productMetaName = product.data.meta.title ? product.data.meta.title : "Cloudflare Docs"; + let productMetaName = product.data.meta.title + ? product.data.meta.title + : "Cloudflare Docs"; if (currentSection === "changelog") { - productMetaName = "Changelog" + productMetaName = "Changelog"; } const titleIdx = head.findIndex((x) => x.tag === "title"); let title: string; // Prefer the title set via frontmatter.head.title. If not, grab the regular frontmatter title value. - const existingTitle = head[titleIdx].content ? head[titleIdx].content?.split( - ` ${DEFAULT_TITLE_DELIMITER} `, - )[0]: frontmatter.title; + const existingTitle = head[titleIdx].content + ? head[titleIdx].content?.split(` ${DEFAULT_TITLE_DELIMITER} `)[0] + : frontmatter.title; title = `${existingTitle} · ${productMetaName}`; @@ -128,8 +130,13 @@ if ( if (frontmatter.pcx_content_type) { ["pcx_content_type", "algolia_content_type"].map((name) => { - const contentType = frontmatter.pcx_content_type - const updatedName = contentType ? (contentType.charAt(0).toUpperCase() + contentType.slice(1)).replace("-", " ") : "" + const contentType = frontmatter.pcx_content_type; + const updatedName = contentType + ? (contentType.charAt(0).toUpperCase() + contentType.slice(1)).replace( + "-", + " ", + ) + : ""; metaTags.push({ name, content: updatedName, @@ -217,7 +224,6 @@ metaTags.map((attrs) => { attrs, }); }); - --- diff --git a/src/pages/changelog/[...slug].astro b/src/pages/changelog/[...slug].astro index 56d282685534443..fda014505c8a891 100644 --- a/src/pages/changelog/[...slug].astro +++ b/src/pages/changelog/[...slug].astro @@ -36,7 +36,8 @@ const props = { noindex: note.data.hidden, chatbot_deprioritize: true, pcx_content_type: "changelog-entry", - products: note.data.products.map(a => a.id), + products: note.data.products.map((a) => a.id), + lastUpdated: note.data.date, }, headings, hideTitle: true, From 6045bc383549b7b65ca68d1895bc31cdac691306 Mon Sep 17 00:00:00 2001 From: Jeremy Fishman Date: Thu, 14 Aug 2025 12:56:39 -0700 Subject: [PATCH 008/202] Changelog for LB zone monitoring improvements (#24223) Add 2025-08-06-zone-monitoring-improvements.mdx to announce a new changelog entry regarding improvements to Load Balancing monitors. --- ...025-08-06-zone-monitoring-improvements.mdx | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 src/content/changelog/load-balancing/2025-08-06-zone-monitoring-improvements.mdx diff --git a/src/content/changelog/load-balancing/2025-08-06-zone-monitoring-improvements.mdx b/src/content/changelog/load-balancing/2025-08-06-zone-monitoring-improvements.mdx new file mode 100644 index 000000000000000..116a5fc681ec152 --- /dev/null +++ b/src/content/changelog/load-balancing/2025-08-06-zone-monitoring-improvements.mdx @@ -0,0 +1,20 @@ +--- +title: Improvements to Monitoring Using Zone Settings +description: Monitors configured with a probe zone have been migrated to new infrastructure. +date: 2025-08-06 +--- + +Cloudflare Load Balancing Monitors support loading and applying settings for a specific zone to monitoring requests to origin endpoints. This feature has been migrated to new infrastructure to improve reliability, performance, and accuracy. + +All zone monitors have been tested against the new infrastructure. There should be no change to health monitoring results of currently healthy and active pools. Newly created or re-enabled pools may need validation of their monitor zone settings before being introduced to service, especially regarding correct application of mTLS. + +### What you can expect: + +- More reliable application of zone settings to monitoring requests, including + - Authenticated Origin Pulls + - Aegis Egress IP Pools + - Argo Smart Routing + - HTTP/2 to Origin +- Improved support and bug fixes for retries, redirects, and proxied origin resolution +- Improved performance and reliability of monitoring requests withing the Cloudflare network +- Unrelated CDN or WAF configuration changes should have no risk of impact to pool health From ebbd3cb7bb89036a8142cf71199e79359dccd6b5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Denise=20Pe=C3=B1a?= <75506267+dcpena@users.noreply.github.com> Date: Thu, 14 Aug 2025 15:43:03 -0500 Subject: [PATCH 009/202] Added transcripts for videos (#24421) --- .../china-network-acceleration/index.yaml | 307 ++++++++- .../stream/onboard-domain-cf/index.yaml | 326 ++++++++- .../sase-1-evolution-corp-networks/index.yaml | 566 +++++++++++++++- .../sase-2-stop-hosting-own-vpn/index.yaml | 618 ++++++++++++++++- .../sase-3-secure-remote-access/index.yaml | 444 +++++++++++- .../stream/sase-4-connect-secure/index.yaml | 510 +++++++++++++- .../stream/sase-5-protect-users/index.yaml | 589 +++++++++++++++- src/content/stream/warp-1-basics/index.yaml | 379 ++++++++++- .../stream/warp-2-diagonostic-logs/index.yaml | 635 +++++++++++++++++- 9 files changed, 4361 insertions(+), 13 deletions(-) diff --git a/src/content/stream/china-network-acceleration/index.yaml b/src/content/stream/china-network-acceleration/index.yaml index f970f5e5eb45431..ce5f66a4a3fb64f 100644 --- a/src/content/stream/china-network-acceleration/index.yaml +++ b/src/content/stream/china-network-acceleration/index.yaml @@ -7,10 +7,311 @@ products: - china-network thumbnail: url: https://pub-d9bf66e086fb4b639107aa52105b49dd.r2.dev/2-China-Express-thumbnail.png -chapters: { +chapters: + { "Introduction and overview of Cloudflare solutions for China": "0s", "Dynamic content outside of Mainland China": "38s", "Access to global services": "01m43s", "Private network connectivity": "02m54s", - "China Network use case and solution overview": "03m43s" -} \ No newline at end of file + "China Network use case and solution overview": "03m43s", + } +transcript: | + + WEBVTT + + 1 + 00:00:03.620 --> 00:00:08.780 + In the last video, we discussed that if your + origin is outside of mainland China and has + + 2 + 00:00:08.780 --> 00:00:11.630 + dynamic content that cannot be cashed within + China, + + 3 + 00:00:11.660 --> 00:00:14.930 + your users may still encounter increased + latency, + + 4 + 00:00:14.960 --> 00:00:17.240 + leading to poor user experience. + + 5 + 00:00:17.270 --> 00:00:22.430 + In this video, we'll go over three main use + cases that we can help address dynamic + + 6 + 00:00:22.430 --> 00:00:24.500 + content outside of mainland China. + + 7 + 00:00:24.530 --> 00:00:28.430 + Access to global services and private network + connectivity. + + 8 + 00:00:28.430 --> 00:00:32.450 + So depending on your use case, + you can choose what best suits your needs. + + 9 + 00:00:32.480 --> 00:00:37.340 + Hello, I'm Jez from Cloudflare here to teach + you about our Cloudflare solutions for + + 10 + 00:00:37.370 --> 00:00:42.530 + mainland China. If your origin is outside of + mainland China and has dynamic content that + + 11 + 00:00:42.530 --> 00:00:46.550 + cannot be cached within China, + CN Global Acceleration, + + 12 + 00:00:46.550 --> 00:00:51.080 + formerly known as China Express, + can help you with this by leveraging + + 13 + 00:00:51.080 --> 00:00:56.060 + dedicated private tunnels established through + our trusted local partners including JD + + 14 + 00:00:56.060 --> 00:01:01.430 + cloud, CME and CBC tech, + we ensure seamless and efficient content + + 15 + 00:01:01.430 --> 00:01:03.770 + delivery. Here's how it works. + + 16 + 00:01:03.770 --> 00:01:08.210 + Traffic received from our China Network data + centers is routed to our premium data + + 17 + 00:01:08.280 --> 00:01:12.420 + centers, which have global acceleration + privileges that are designed to handle + + 18 + 00:01:12.420 --> 00:01:14.190 + dynamic traffic with ease. + + 19 + 00:01:14.520 --> 00:01:18.060 + This includes typical use cases like web API + calls, + + 20 + 00:01:18.060 --> 00:01:23.400 + as well as more complex scenarios such as + dynamic traffic management or multi origin + + 21 + 00:01:23.400 --> 00:01:28.650 + configurations. For example, + customers using Cloudflare SaaS features like + + 22 + 00:01:28.650 --> 00:01:34.050 + R2 for asset storage can integrate these + capabilities into our solutions seamlessly. + + 23 + 00:01:34.080 --> 00:01:38.880 + Once processed, the traffic is transferred + through a partner's dedicated private tunnel + + 24 + 00:01:38.910 --> 00:01:43.710 + to the global public internet, + ensuring high performance and reliability. + + 25 + 00:01:43.860 --> 00:01:48.690 + Besides accelerating dynamic content, + you can also reliably access Cloudflare One + + 26 + 00:01:48.690 --> 00:01:52.230 + services like Warp, Magic WAN, + and travel SIM cards. + + 27 + 00:01:52.230 --> 00:01:56.700 + With Warp Global acceleration, + Warp client can be extended to China for your + + 28 + 00:01:56.700 --> 00:02:01.770 + users under Pre-signed agreements to access + the same Zero Trust Network access services, + + 29 + 00:02:01.770 --> 00:02:06.930 + just as the rest of your global users, + while experiencing stable connectivity + + 30 + 00:02:06.930 --> 00:02:11.040 + anywhere within China, + no matter if you're at home or a coffee shop. + + 31 + 00:02:11.070 --> 00:02:15.730 + Once you receive our dedicated China IPS + through Cloudflare and have Warp setup up, + + 32 + 00:02:15.730 --> 00:02:18.130 + all you need to do is override the following. + + 33 + 00:02:18.160 --> 00:02:20.110 + Warp endpoints for each device. + + 34 + 00:02:20.140 --> 00:02:24.130 + Warp endpoint API endpoint and endpoint. + + 35 + 00:02:24.460 --> 00:02:29.260 + Verify the colocation center is your desired + location under Warp preferences. + + 36 + 00:02:30.370 --> 00:02:33.460 + And now you should be able to access global + services. + + 37 + 00:02:34.480 --> 00:02:38.740 + As for users who are temporarily in China, + we can offer travel SIM cards, + + 38 + 00:02:38.740 --> 00:02:42.610 + which connect to our Warp client for a + seamless and secure mobile acceleration + + 39 + 00:02:42.610 --> 00:02:47.170 + abroad. By inserting the SIM card or applying + the eSIM to an employee's phone, + + 40 + 00:02:47.170 --> 00:02:50.200 + corporate devices, whether it be laptops or + tablets, + + 41 + 00:02:50.230 --> 00:02:54.400 + can then connect to their organization's Warp + client through mobile hotspot. + + 42 + 00:02:54.430 --> 00:02:58.810 + Lastly, if your goal is to scale and + accelerate private enterprise networks from + + 43 + 00:02:58.810 --> 00:03:02.410 + China, Magic WAN Global Acceleration can help + you with that. + + 44 + 00:03:02.410 --> 00:03:05.170 + You can securely connect to any traffic + source, + + 45 + 00:03:05.170 --> 00:03:08.830 + such as offices and data centers to + Cloudflare network, + + 46 + 00:03:08.830 --> 00:03:12.850 + while configuring routing policies tailored + to your corporate networking needs from + + 47 + 00:03:12.850 --> 00:03:18.250 + China. To extend Magic WAN into China, + we provide a customer premises equipment or a + + 48 + 00:03:18.280 --> 00:03:22.900 + CPE device which will be shipped to your + China based location once the CPE is + + 49 + 00:03:22.920 --> 00:03:25.470 + connected to the internet in your physical + location. + + 50 + 00:03:25.470 --> 00:03:29.910 + Traffic from users who are using the same + internet in that location will be routed + + 51 + 00:03:29.910 --> 00:03:34.710 + through our dedicated private tunnel to any + resource or service to make the process + + 52 + 00:03:34.710 --> 00:03:37.830 + effortless. Our team will help you in + configuring the CPE. + + 53 + 00:03:38.070 --> 00:03:43.650 + To sum up. Our solutions are designed to meet + your specific needs and can be selected a la + + 54 + 00:03:43.650 --> 00:03:46.950 + carte if you need to optimize dynamic data + delivery, + + 55 + 00:03:46.950 --> 00:03:52.380 + whether it's API calls or to integrations or + special use cases within a China network + + 56 + 00:03:52.380 --> 00:03:56.130 + zone. Cdn global acceleration is the ideal + choice. + + 57 + 00:03:56.160 --> 00:04:01.170 + Looking to connect to global services across + China with company enforced policies? + + 58 + 00:04:01.170 --> 00:04:07.050 + Choose Warp Global Acceleration for managing + Enterprise networking or accessing global + + 59 + 00:04:07.050 --> 00:04:09.420 + services from your China based offices. + + 60 + 00:04:09.450 --> 00:04:12.960 + Magic WAN global acceleration is your go to + solution. + + 61 + 00:04:13.830 --> 00:04:17.340 + Thanks for watching. You can reach out to our + sales team to learn more. \ No newline at end of file diff --git a/src/content/stream/onboard-domain-cf/index.yaml b/src/content/stream/onboard-domain-cf/index.yaml index 91f731f23273674..2de221336e6201d 100644 --- a/src/content/stream/onboard-domain-cf/index.yaml +++ b/src/content/stream/onboard-domain-cf/index.yaml @@ -12,4 +12,328 @@ chapters: { "Getting Started: Domain Onboarding": "55s", "DNS and Reverse Proxy Explained": "01m24s", "Request Lifecycle and Performance Optimization": "03m20s" -} \ No newline at end of file +} +transcript: | + + WEBVTT + + 1 + 00:00:00.280 --> 00:00:04.760 + Cloudflare operates a global network that + makes your online presence faster and protect + + 2 + 00:00:04.760 --> 00:00:06.120 + it from cyber attacks. + + 3 + 00:00:07.160 --> 00:00:09.840 + When you connect a website or app to + Cloudflare, + + 4 + 00:00:09.840 --> 00:00:15.040 + we act as both the authoritative DNS provider + and a reverse proxy that sits between your + + 5 + 00:00:15.040 --> 00:00:17.160 + visitors and your origin servers. + + 6 + 00:00:17.880 --> 00:00:20.960 + When a visitor or an attacker tries to reach + your website, + + 7 + 00:00:21.120 --> 00:00:25.080 + those requests are first routed to the + Cloudflare network instead of your origin + + 8 + 00:00:25.080 --> 00:00:30.240 + server. Cloudflare processes those requests, + mitigating malicious traffic while speeding + + 9 + 00:00:30.240 --> 00:00:31.600 + up legitimate traffic. + + 10 + 00:00:33.520 --> 00:00:38.000 + Our services are customizable to give you + granular control over your traffic. + + 11 + 00:00:38.160 --> 00:00:42.120 + You can write rules to cache, + load, balance and redirect requests, + + 12 + 00:00:42.360 --> 00:00:45.000 + modify headers, execute code, + and more. + + 13 + 00:00:46.040 --> 00:00:50.880 + Many of our services are on by default, + such as DDoS protection and caching, + + 14 + 00:00:50.880 --> 00:00:54.240 + so your traffic will automatically be safer + and faster. + + 15 + 00:00:55.480 --> 00:00:58.280 + To make this possible, + you need to onboard your domain to + + 16 + 00:00:58.280 --> 00:01:03.440 + Cloudflare. The most common way to onboard + your domain is to update your DNS name + + 17 + 00:01:03.440 --> 00:01:06.370 + servers to the Cloudflare name servers we + provide you, + + 18 + 00:01:06.610 --> 00:01:09.690 + which makes Cloudflare your authoritative DNS + provider. + + 19 + 00:01:10.650 --> 00:01:13.730 + You do this at the provider you purchase your + domain name from, + + 20 + 00:01:13.730 --> 00:01:17.570 + such as a registrar. If you need a new + domain, + + 21 + 00:01:17.570 --> 00:01:20.370 + you can purchase one at cost from the + Cloudflare registrar, + + 22 + 00:01:20.490 --> 00:01:23.610 + which is automatically configured to use our + name servers. + + 23 + 00:01:24.650 --> 00:01:27.610 + Let's review the basics of name servers and + DNS. + + 24 + 00:01:27.890 --> 00:01:33.210 + A name server is a service operated by your + authoritative DNS provider that acts as a + + 25 + 00:01:33.210 --> 00:01:35.890 + source of truth for your domain's DNS + records. + + 26 + 00:01:36.570 --> 00:01:40.810 + Dns records map a human readable hostname, + such as example.com, + + 27 + 00:01:40.810 --> 00:01:43.650 + to machine readable IP addresses or data. + + 28 + 00:01:44.570 --> 00:01:48.890 + The IP address listed in a DNS record + identifies where your origin server is + + 29 + 00:01:48.890 --> 00:01:54.530 + hosted. These DNS records tell your + authoritative DNS provider how to respond to + + 30 + 00:01:54.530 --> 00:01:56.370 + DNS queries for your domain. + + 31 + 00:01:56.770 --> 00:02:01.690 + So altogether, DNS allows internet browsers + such as Google Chrome to find the correct + + 32 + 00:02:01.690 --> 00:02:06.250 + content. Then the browser can make HTTP + requests to load the content for your + + 33 + 00:02:06.250 --> 00:02:10.970 + visitors. If you're not using a reverse proxy + such as Cloudflare. + + 34 + 00:02:11.130 --> 00:02:15.490 + The browser makes HTTP requests directly to + the IP address of your origin server. + + 35 + 00:02:15.530 --> 00:02:19.650 + This is not secure because your origin is + exposed to the internet without protection. + + 36 + 00:02:21.010 --> 00:02:25.290 + When Cloudflare is in front of your origin, + we act as both your authoritative DNS + + 37 + 00:02:25.290 --> 00:02:28.850 + provider and a reverse proxy for your HTTP + requests. + + 38 + 00:02:29.330 --> 00:02:32.850 + We respond to DNS queries with Cloudflare IP + addresses, + + 39 + 00:02:33.050 --> 00:02:37.090 + which makes your HTTP traffic go through + Cloudflare instead of directly to your + + 40 + 00:02:37.090 --> 00:02:40.850 + origin. This process is called reverse + Proxying, + + 41 + 00:02:40.970 --> 00:02:44.610 + which allows us to hide and therefore protect + your origin server. + + 42 + 00:02:44.970 --> 00:02:49.330 + Furthermore, we highly recommend blocking + traffic that doesn't come through Cloudflare + + 43 + 00:02:49.330 --> 00:02:54.210 + by configuring your origins firewall to only + allow Cloudflare IP addresses or using + + 44 + 00:02:54.210 --> 00:03:01.170 + Cloudflare Tunnel. You can identify which + traffic is proxy in the DNS records table in + + 45 + 00:03:01.170 --> 00:03:02.530 + the Cloudflare dashboard. + + 46 + 00:03:03.530 --> 00:03:08.130 + If the proxy status is set to proxy, + requests for those hostname will flow through + + 47 + 00:03:08.130 --> 00:03:09.370 + the Cloudflare network. + + 48 + 00:03:09.570 --> 00:03:12.450 + This will start happening once you update + your nameservers. + + 49 + 00:03:13.330 --> 00:03:15.380 + If the status is as DNS only. + + 50 + 00:03:15.500 --> 00:03:19.620 + Requests for those hostnames will only use + Cloudflare for DNS resolution. + + 51 + 00:03:20.700 --> 00:03:25.860 + Let's follow an HTTP request as it gets + processed by Cloudflare when someone visits + + 52 + 00:03:25.860 --> 00:03:27.940 + or tries to attack your website or app. + + 53 + 00:03:28.100 --> 00:03:32.460 + That request will be routed to the Cloudflare + data center that's closest to that visitor. + + 54 + 00:03:34.220 --> 00:03:38.740 + If a request is from a legitimate user, + we check if it's for a resource that's in the + + 55 + 00:03:38.740 --> 00:03:41.300 + Cloudflare cache. If we don't have it cached, + + 56 + 00:03:41.300 --> 00:03:43.620 + we proxy the request to your origin server. + + 57 + 00:03:44.980 --> 00:03:46.940 + We then cache the origins response. + + 58 + 00:03:47.060 --> 00:03:50.220 + So the next time Cloudflare sees a request + for the same resource, + + 59 + 00:03:50.220 --> 00:03:51.860 + we can deliver it straight away. + + 60 + 00:03:52.780 --> 00:03:55.620 + We block suspicious requests from reaching + your origin, + + 61 + 00:03:55.820 --> 00:03:59.300 + only allowing legitimate users and speeding + up their experience. + + 62 + 00:04:00.420 --> 00:04:03.540 + So you will always have the most up to date + security posture, + + 63 + 00:04:03.620 --> 00:04:06.500 + including protection from Sierra de + vulnerabilities, + + 64 + 00:04:06.620 --> 00:04:08.740 + advanced DDoS attacks, + and more. + + 65 + 00:04:10.060 --> 00:04:12.580 + Cloudflare is an extension of your + infrastructure, + + 66 + 00:04:12.700 --> 00:04:15.140 + keeping your site safe and highly available. + + 67 + 00:04:15.300 --> 00:04:17.580 + Get started with onboarding your domain + today. \ No newline at end of file diff --git a/src/content/stream/sase-1-evolution-corp-networks/index.yaml b/src/content/stream/sase-1-evolution-corp-networks/index.yaml index 24cfb17dd011062..9bb4d8a91bdc50e 100644 --- a/src/content/stream/sase-1-evolution-corp-networks/index.yaml +++ b/src/content/stream/sase-1-evolution-corp-networks/index.yaml @@ -11,7 +11,567 @@ chapters: { "Introduction to SASE and Modern Corporate Networking": "0s", "The Evolution of Corporate Networks and Security Challenges": "01m08s", "Why Legacy Solutions Like VPNs and SD-WAN Are Insufficient": "03m05s", - "How Cloudflare’s Global Network Powers SASE Solutions": "04m13s", - "The Role of Cloudflare’s Connectivity Cloud in Securing Enterprises": "05m28s", + "How Cloudflare's Global Network Powers SASE Solutions": "04m13s", + "The Role of Cloudflare's Connectivity Cloud in Securing Enterprises": "05m28s", "Simplified Security, Network Optimization, and Cost Savings with Cloudflare": "06m15s" -} \ No newline at end of file +} +transcript: | + + WEBVTT + + 1 + 00:00:07.310 --> 00:00:12.080 + Hi, I'm Simon here at Cloudflare, + and I'm going to talk about our SASE platform + + 2 + 00:00:12.080 --> 00:00:14.660 + to help you modernize your corporate network. + + 3 + 00:00:14.720 --> 00:00:18.920 + Many company networks have been built on + technology that simply can't cope with + + 4 + 00:00:18.920 --> 00:00:21.620 + today's security, performance and monitoring + needs. + + 5 + 00:00:21.650 --> 00:00:25.910 + The demands on a corporate network have + evolved dramatically over the past few years. + + 6 + 00:00:25.910 --> 00:00:29.660 + Those working in IT and networking are really + struggling with the fact that users, + + 7 + 00:00:29.660 --> 00:00:34.670 + their devices, and the applications and data + they need to access are distributed all over + + 8 + 00:00:34.670 --> 00:00:38.000 + the place, beyond the perimeter of the + classic corporate network. + + 9 + 00:00:38.030 --> 00:00:41.840 + They're trying to address this problem with + legacy approaches, which increase cost and + + 10 + 00:00:41.840 --> 00:00:45.350 + complexity, and can result in a solution that + doesn't perform that well, + + 11 + 00:00:45.350 --> 00:00:47.390 + leading to really irritated users. + + 12 + 00:00:47.390 --> 00:00:50.990 + So in response to these challenges, + the concept of SASE has evolved. + + 13 + 00:00:50.990 --> 00:00:54.230 + It stands for Secure Access Service Edge. + + 14 + 00:00:54.260 --> 00:00:56.630 + It's a new approach to networking and + security, + + 15 + 00:00:56.630 --> 00:01:00.770 + which reduces complexity, + as well as bringing stronger access controls + + 16 + 00:01:00.770 --> 00:01:04.100 + and improved performance for the protection + of applications, + + 17 + 00:01:04.100 --> 00:01:06.920 + users, devices and your company data. + + 18 + 00:01:06.950 --> 00:01:10.790 + But how does it work? First, + let's go back and let's look at how + + 19 + 00:01:10.820 --> 00:01:13.790 + networking and security solutions used to be + designed. + + 20 + 00:01:13.820 --> 00:01:18.920 + Decades ago, employees would travel into an + office and use the company's local network, + + 21 + 00:01:18.920 --> 00:01:23.420 + which was made up of that network, + plus also connections to branch offices, + + 22 + 00:01:23.420 --> 00:01:28.790 + maybe a data center, and various other + locations via private leased lines using + + 23 + 00:01:28.820 --> 00:01:33.470 + technologies such as MultiProtocol Label + Switching or MPLS. + + 24 + 00:01:33.500 --> 00:01:37.880 + You are paying for expensive private + connectivity with dedicated bandwidth, + + 25 + 00:01:37.880 --> 00:01:42.380 + and typically all Internet access was + backhauled through these connections to a + + 26 + 00:01:42.380 --> 00:01:46.310 + single data center, where firewalls and + proxies would then inspect the traffic and + + 27 + 00:01:46.310 --> 00:01:47.630 + apply the security controls. + + 28 + 00:01:47.630 --> 00:01:52.790 + But over time, as the available Internet + bandwidth increased for less cost, + + 29 + 00:01:52.790 --> 00:01:57.320 + the need for these dedicated lines diminished + and software defined networks, + + 30 + 00:01:57.320 --> 00:02:02.780 + commonly known as SD-WAN became popular, + helping businesses better manage traffic and + + 31 + 00:02:02.810 --> 00:02:08.400 + optimize usage of cheaper Internet based + IPsec tunnels versus these expensive leased + + 32 + 00:02:08.400 --> 00:02:15.120 + lines. However, SD-WAN still left businesses + managing complex on premises appliances and + + 33 + 00:02:15.120 --> 00:02:18.690 + having to deal with configuration changes and + software updates. + + 34 + 00:02:18.720 --> 00:02:24.210 + Also, firewalls associated with these SD-WAN + appliances were relatively limited and often + + 35 + 00:02:24.210 --> 00:02:27.870 + paired with extra hardware for a more + complete security solution. + + 36 + 00:02:27.900 --> 00:02:31.860 + While all this was going on, + the proliferation of devices such as laptops + + 37 + 00:02:31.860 --> 00:02:35.550 + and smartphones were allowing employees to + work from anywhere, + + 38 + 00:02:35.550 --> 00:02:40.140 + so VPNs were added into the mix, + where people could dial up to the VPN and + + 39 + 00:02:40.140 --> 00:02:44.130 + access their company network. Often all their + Internet access was also funneled through + + 40 + 00:02:44.130 --> 00:02:47.880 + these VPN connections, + so the same security policies office users + + 41 + 00:02:47.880 --> 00:02:51.870 + had would also be applied to the remote user + traffic and it all came back through that + + 42 + 00:02:51.870 --> 00:02:56.370 + company data center. And this approach is + really hard to manage with multiple vendors + + 43 + 00:02:56.370 --> 00:02:59.880 + and different appliances and different + dashboards to configure the policies across + + 44 + 00:02:59.880 --> 00:03:03.090 + all these technologies, + and they're not really designed to work well + + 45 + 00:03:03.090 --> 00:03:05.130 + in the modern distributed workplace. + + 46 + 00:03:05.130 --> 00:03:08.970 + But today, it's not just users and devices + that have left the office and company + + 47 + 00:03:09.000 --> 00:03:12.840 + network, but the applications and data live + all over the place as well. + + 48 + 00:03:12.840 --> 00:03:18.480 + They've migrated out of the data center into + cloud infrastructure such as AWS, + + 49 + 00:03:18.510 --> 00:03:23.100 + Azure and Google. Some applications have been + completely reimagined as SaaS apps, + + 50 + 00:03:23.100 --> 00:03:27.240 + where companies no longer run the servers, + but just rent access to tenants in large + + 51 + 00:03:27.240 --> 00:03:30.150 + software deployments, + you know, such as Salesforce or Workday and + + 52 + 00:03:30.150 --> 00:03:33.750 + Zoom. And users are not just taking a short + trip away from the office anymore. + + 53 + 00:03:33.750 --> 00:03:35.850 + Some people don't even visit one. + + 54 + 00:03:35.850 --> 00:03:39.210 + They're working from home, + in coffee shops, even on airplanes. + + 55 + 00:03:39.210 --> 00:03:43.320 + And sometimes they might visit an office, + yet the same needs still exist: + + 56 + 00:03:43.320 --> 00:03:47.340 + the right person should get access to the + right applications and data. + + 57 + 00:03:47.370 --> 00:03:52.770 + Latency or the performance of the application + should be really high quality and all while + + 58 + 00:03:52.770 --> 00:03:57.360 + using secure devices and being protected from + Internet threats such as phishing campaigns + + 59 + 00:03:57.360 --> 00:03:58.500 + and ransomware attacks. + + 60 + 00:03:58.500 --> 00:04:03.090 + Because of this constant need for everyone to + access anything from anywhere, + + 61 + 00:04:03.120 --> 00:04:08.280 + SASE architectures evolved where the + intelligence in the network has migrated out + + 62 + 00:04:08.280 --> 00:04:13.860 + of these on premises appliances and now into + massively scalable global cloud networks. + + 63 + 00:04:13.860 --> 00:04:16.710 + So how does Cloudflare SASE platform work? + + 64 + 00:04:16.710 --> 00:04:22.320 + Well, first, and probably most importantly, + we've built a massive network spread all over + + 65 + 00:04:22.320 --> 00:04:26.760 + the globe. We've deployed thousands of + servers in data centers in hundreds of + + 66 + 00:04:26.760 --> 00:04:30.720 + cities, creating peering relationships with + thousands of other networks. + + 67 + 00:04:30.750 --> 00:04:34.620 + On top of all of that, + we've ensured that we have connectivity in + + 68 + 00:04:34.620 --> 00:04:36.810 + all the important Internet exchanges. + + 69 + 00:04:36.810 --> 00:04:40.980 + These are places where all the big + connectivity of the Internet is shared. + + 70 + 00:04:41.010 --> 00:04:43.800 + To give you an idea of the scale of this huge + network, + + 71 + 00:04:43.800 --> 00:04:47.400 + it handles around 20% of all Internet web + traffic, + + 72 + 00:04:47.400 --> 00:04:50.880 + and it can deal with the largest denial of + service attacks that have ever been seen. + + 73 + 00:04:50.910 --> 00:04:54.900 + The scale and performance of this network is + really important because from a SASE + + 74 + 00:04:54.930 --> 00:04:57.600 + perspective, you're going to be routing all + your user, + + 75 + 00:04:57.600 --> 00:05:00.240 + device and network traffic into it. + + 76 + 00:05:00.360 --> 00:05:05.070 + Every server in our network runs all the + capabilities you need to inspect and secure + + 77 + 00:05:05.070 --> 00:05:07.740 + traffic. So access controls, + traffic routing, + + 78 + 00:05:07.740 --> 00:05:11.640 + caching, all run on the server that your user + or network is connecting to. + + 79 + 00:05:11.730 --> 00:05:15.870 + So now, instead of all the security controls + and network logic spread across a variety of + + 80 + 00:05:15.870 --> 00:05:19.620 + different vendors and appliances and services + that you're having to maintain, + + 81 + 00:05:19.620 --> 00:05:24.960 + it's centralized in a cloud service that + operates and points all over the globe, + + 82 + 00:05:24.960 --> 00:05:28.980 + so that each user or network is connected to + a fast local data center. + + 83 + 00:05:28.980 --> 00:05:33.210 + And Cloudflare SASE platform is part of a + greater connectivity cloud. + + 84 + 00:05:33.210 --> 00:05:35.130 + So what's a connectivity cloud? + + 85 + 00:05:35.130 --> 00:05:40.080 + It's a unified platform of cloud native + services that spans networking, + + 86 + 00:05:40.080 --> 00:05:44.970 + security and application performance, + and it's designed to help companies regain + + 87 + 00:05:44.970 --> 00:05:47.430 + control over their technology infrastructure. + + 88 + 00:05:47.460 --> 00:05:52.140 + Our connectivity cloud goes way beyond just + protecting employees and their access to + + 89 + 00:05:52.170 --> 00:05:57.090 + company resources. It's also used to protect + public assets like websites and APIs. + + 90 + 00:05:57.090 --> 00:06:00.090 + In fact, we run one of the world's fastest + DNS servers. + + 91 + 00:06:00.090 --> 00:06:03.660 + We've even exposed the underlying components + of our platform, + + 92 + 00:06:03.660 --> 00:06:07.170 + letting developers write and run their code + directly on our network. + + 93 + 00:06:07.260 --> 00:06:11.700 + Then they can extend our existing services or + build entirely new applications, + + 94 + 00:06:11.730 --> 00:06:14.520 + leading you to an infinite amount of things + you can build. + + 95 + 00:06:15.180 --> 00:06:20.080 + So to summarize Cloudflare SASE platform, + which runs in our connectivity cloud, + + 96 + 00:06:20.080 --> 00:06:22.960 + allows companies to reimagine their company + network. + + 97 + 00:06:22.990 --> 00:06:27.220 + Users connect to Cloudflare's global network + via a data center that's close to them, + + 98 + 00:06:27.220 --> 00:06:30.670 + and that server then ensures that they don't + access phishing sites on the Internet, or it + + 99 + 00:06:30.700 --> 00:06:33.820 + gives them secure access to an internal + company application. + + 100 + 00:06:33.850 --> 00:06:37.150 + All of this is happening in milliseconds + across our vast network. + + 101 + 00:06:37.150 --> 00:06:41.290 + Because we can deliver all these capabilities + in a single platform instead of different + + 102 + 00:06:41.290 --> 00:06:45.550 + vendor solutions, it means that companies can + centralize all that management into a single, + + 103 + 00:06:45.550 --> 00:06:46.900 + well-integrated dashboard. + + 104 + 00:06:46.900 --> 00:06:51.040 + This ultimately drives down your cost less + time used to manage the services, + + 105 + 00:06:51.070 --> 00:06:54.280 + less or often no hardware to purchase and + maintain, + + 106 + 00:06:54.280 --> 00:06:57.220 + and it's cheaper to purchase the actual final + solution. + + 107 + 00:06:57.220 --> 00:06:58.450 + Well, thanks for watching. + + 108 + 00:06:58.450 --> 00:07:02.650 + This video is part of a series which explains + how to build your new corporate network using + + 109 + 00:07:02.650 --> 00:07:04.390 + Cloudflare SASE platform. + + 110 + 00:07:04.390 --> 00:07:06.610 + Watch other videos in this series to learn + more. + + 111 + 00:07:08.440 --> 00:07:10.120 + Hi, I'm Simon from Cloudflare. + + 112 + 00:07:10.150 --> 00:07:11.710 + Congrats on finding this video. + + 113 + 00:07:11.710 --> 00:07:15.490 + We also cover a wide variety of topics + including application security, + + 114 + 00:07:15.490 --> 00:07:18.220 + corporate networking, + and all the developer content the Internet + + 115 + 00:07:18.220 --> 00:07:20.800 + can hold. Follow us online and thanks for + watching! \ No newline at end of file diff --git a/src/content/stream/sase-2-stop-hosting-own-vpn/index.yaml b/src/content/stream/sase-2-stop-hosting-own-vpn/index.yaml index 8373a043689df6c..e9e3636e6fb2746 100644 --- a/src/content/stream/sase-2-stop-hosting-own-vpn/index.yaml +++ b/src/content/stream/sase-2-stop-hosting-own-vpn/index.yaml @@ -14,4 +14,620 @@ chapters: { "Implementing Identity-Based, Clientless Access Control Access Control": "02m42s", "Leveraging Anycast Networking for Faster and More Secure Application Access": "05m36s", "Enhancing Security with Micro-Segmentation and Cloudflare's Global Network": "06m59s" -} \ No newline at end of file +} +transcript: | + + WEBVTT + + 1 + 00:00:07.160 --> 00:00:12.140 + Corporate networks are often used to allow + employees to access sensitive information in + + 2 + 00:00:12.140 --> 00:00:15.920 + private, self-hosted applications, + such as an internal wiki, + + 3 + 00:00:15.950 --> 00:00:18.500 + a HR system, or a source code repository. + + 4 + 00:00:18.530 --> 00:00:22.040 + While some applications have migrated into + the cloud as SaaS apps, + + 5 + 00:00:22.040 --> 00:00:25.160 + there are still applications that are run and + maintained by IT. + + 6 + 00:00:25.490 --> 00:00:29.510 + These days, most of these self-hosted + applications run in a web server and are + + 7 + 00:00:29.510 --> 00:00:33.980 + deployed either in a private data center or + in a public cloud such as AWS, + + 8 + 00:00:34.010 --> 00:00:38.390 + Azure, or Google. Access to these + applications is usually limited to internal + + 9 + 00:00:38.390 --> 00:00:42.290 + employees, but it's common to allow some form + of restricted access to partners or + + 10 + 00:00:42.290 --> 00:00:46.370 + contractors. The old way of doing things was + to have users either come into a physical + + 11 + 00:00:46.400 --> 00:00:51.140 + office or connect remotely via a VPN, + giving them access to that corporate network + + 12 + 00:00:51.140 --> 00:00:52.760 + so they could access the application. + + 13 + 00:00:52.760 --> 00:00:57.890 + But these VPN solutions use on premises + hardware appliances through which every user + + 14 + 00:00:57.890 --> 00:01:00.960 + request passes, creating a bottleneck and a + security risk. + + 15 + 00:01:00.990 --> 00:01:04.980 + In fact, recently, many on premises VPN + vendors such as Cisco, + + 16 + 00:01:05.010 --> 00:01:10.380 + Checkpoint, and Fortinet have reported a wide + range of vulnerabilities which requires IT + + 17 + 00:01:10.380 --> 00:01:13.500 + and security teams to scramble to update + their systems. + + 18 + 00:01:13.770 --> 00:01:15.630 + But there's another way to do this. + + 19 + 00:01:15.660 --> 00:01:19.440 + Did you know that Cloudflare can be used to + easily create secure access to these + + 20 + 00:01:19.440 --> 00:01:22.410 + self-hosted applications using our SASE + platform? + + 21 + 00:01:22.410 --> 00:01:24.540 + That's part of our connectivity cloud? + + 22 + 00:01:24.570 --> 00:01:28.470 + Well, similar to how a legacy VPN works, + but using a much, + + 23 + 00:01:28.470 --> 00:01:30.270 + much more modern cloud approach. + + 24 + 00:01:30.300 --> 00:01:33.600 + Let's take a look at how we improve on the + old way of doing things, + + 25 + 00:01:33.600 --> 00:01:36.360 + and create greater security for application + access. + + 26 + 00:01:36.360 --> 00:01:40.920 + The first objective is to create connectivity + between the user's browser and the + + 27 + 00:01:40.920 --> 00:01:44.550 + application. Right. So there are two parts to + this. The connection from Cloudflare to the + + 28 + 00:01:44.550 --> 00:01:47.400 + app and the connection between the user and + Cloudflare. + + 29 + 00:01:47.430 --> 00:01:51.270 + Cloudflare is going to sit in the middle and + apply security policies and use its vast + + 30 + 00:01:51.270 --> 00:01:54.660 + network to protect the application and + improve response times. + + 31 + 00:01:54.660 --> 00:01:57.870 + For the first part, to create connectivity + from Cloudflare to the app, + + 32 + 00:01:57.870 --> 00:02:01.530 + we use tunnels that a variety of different + methods you can use. + + 33 + 00:02:01.530 --> 00:02:06.270 + You can connect on premises networks to + Cloudflare via IPsec or GRE tunnels, + + 34 + 00:02:06.270 --> 00:02:08.700 + typically using your existing network + hardware, + + 35 + 00:02:08.700 --> 00:02:13.200 + or if your applications are running at a data + center where Cloudflare already has its + + 36 + 00:02:13.200 --> 00:02:18.300 + servers, we can connect directly from your + servers to our servers inside that data + + 37 + 00:02:18.330 --> 00:02:21.990 + center. But for this example, + we're going to talk about using a software + + 38 + 00:02:22.020 --> 00:02:26.250 + agent. It's just a small daemon that is + installed either directly on the application + + 39 + 00:02:26.250 --> 00:02:29.970 + server or runs on a dedicated server on the + same local network. + + 40 + 00:02:30.000 --> 00:02:33.030 + The software then creates a secure tunnel + back to Cloudflare. + + 41 + 00:02:33.060 --> 00:02:36.990 + This tunnel maintains a constant connection + to two Cloudflare data centers, + + 42 + 00:02:36.990 --> 00:02:40.140 + so it's always available, + and now your traffic can flow between your + + 43 + 00:02:40.140 --> 00:02:42.690 + Cloudflare network and the application. + + 44 + 00:02:42.930 --> 00:02:46.200 + Now for the second part, + we need to connect your users to Cloudflare, + + 45 + 00:02:46.200 --> 00:02:48.960 + which we're going to do in this example using + public DNS. + + 46 + 00:02:48.990 --> 00:02:51.720 + We'll associate a public hostname with the + application. + + 47 + 00:02:51.720 --> 00:02:54.480 + Request to this hostname will resolve to + Cloudflare, + + 48 + 00:02:54.480 --> 00:02:58.150 + which in turn proxies and routes traffic down + the tunnel to the application, + + 49 + 00:02:58.150 --> 00:03:02.710 + but hold on a second. A public DNS record and + a tunnel directly to the server? + + 50 + 00:03:02.740 --> 00:03:06.700 + If we didn't take this any further, + we could now access this internal application + + 51 + 00:03:06.700 --> 00:03:09.310 + from anywhere just by heading to the new + public hostname. + + 52 + 00:03:09.340 --> 00:03:13.270 + What we need to do is add authentication and + authorization into the mix. + + 53 + 00:03:13.270 --> 00:03:16.270 + Because Cloudflare is now in front of access + to the application, + + 54 + 00:03:16.270 --> 00:03:19.750 + we can integrate with your existing company + identity providers. + + 55 + 00:03:19.750 --> 00:03:23.770 + So anyone attempting to access is first + redirected to your identity provider to + + 56 + 00:03:23.800 --> 00:03:28.060 + authenticate. Now this is where it gets + interesting because you can add multiple + + 57 + 00:03:28.060 --> 00:03:30.880 + identity providers in front of the same + application. + + 58 + 00:03:30.880 --> 00:03:35.620 + So for example, you might use your main + company directory where all your employee + + 59 + 00:03:35.620 --> 00:03:39.880 + accounts reside, but you might also integrate + a separate identity service just for + + 60 + 00:03:39.880 --> 00:03:42.460 + contractors, partners and other third party + users. + + 61 + 00:03:42.490 --> 00:03:45.700 + We also support consumer identity providers + such as Facebook, + + 62 + 00:03:45.700 --> 00:03:50.620 + Google or GitHub. In fact, + any SAML or OAuth identity service can be + + 63 + 00:03:50.620 --> 00:03:55.300 + used. Now, these identity integrations don't + just provide authentication. + + 64 + 00:03:55.300 --> 00:03:57.940 + It's possible to import user and group + information. + + 65 + 00:03:57.940 --> 00:03:59.830 + Which brings us on to the next step. + + 66 + 00:03:59.830 --> 00:04:02.710 + Now that we've ensured a user has + authenticated, + + 67 + 00:04:02.710 --> 00:04:07.270 + we can start to leverage their identity + information and other data to create an + + 68 + 00:04:07.270 --> 00:04:12.100 + access policy that defines who should and + should not get access to the application. + + 69 + 00:04:12.100 --> 00:04:13.930 + Let's build a policy here in real time. + + 70 + 00:04:13.960 --> 00:04:18.910 + A range of different attributes can be used + that define who is allowed or denied access. + + 71 + 00:04:18.910 --> 00:04:23.320 + We started by adding an identity provider, + so users first need to authenticate. + + 72 + 00:04:23.350 --> 00:04:27.040 + Let's take it a little further and leverage + group information from the same identity + + 73 + 00:04:27.070 --> 00:04:32.410 + service. We can say only users in the full + time employees group have access to the + + 74 + 00:04:32.410 --> 00:04:37.360 + internal wiki. The identity service can also + tell us how they authenticated. + + 75 + 00:04:37.360 --> 00:04:39.100 + So let's add that to our policy. + + 76 + 00:04:39.100 --> 00:04:43.300 + The requirement that they must have + authenticated using MFA or multi-factor + + 77 + 00:04:43.300 --> 00:04:46.930 + authentication. In fact, + let's say that they have to specifically use + + 78 + 00:04:46.930 --> 00:04:50.290 + a hard token such as a FIDO certified key. + + 79 + 00:04:50.320 --> 00:04:53.320 + Finally, we only want users working from + Canada, + + 80 + 00:04:53.350 --> 00:04:56.120 + the US or Germany to access the application. + + 81 + 00:04:56.150 --> 00:05:01.160 + So let's add to the policy that only traffic + coming from IP addresses geolocated in those + + 82 + 00:05:01.160 --> 00:05:06.200 + countries is allowed. Now, + full time employees working from somewhere in + + 83 + 00:05:06.200 --> 00:05:11.060 + Canada who have authenticated using a strong + set of credentials will be able to access the + + 84 + 00:05:11.060 --> 00:05:13.160 + company wiki. Let's take a look at this in + action. + + 85 + 00:05:13.190 --> 00:05:15.710 + The user just needs to navigate to the public + hostname, + + 86 + 00:05:15.710 --> 00:05:17.300 + authenticate, and bingo! + + 87 + 00:05:17.330 --> 00:05:22.160 + They have access from anywhere in the world + with only a browser to our privately hosted + + 88 + 00:05:22.160 --> 00:05:26.330 + application. Simple. What a difference from + the old way of doing things. + + 89 + 00:05:26.360 --> 00:05:31.700 + Also, it's important to note that all traffic + from browser to application is secured using + + 90 + 00:05:31.700 --> 00:05:36.410 + standard TLS and SSL encryption, + keeping the application data safe. + + 91 + 00:05:36.440 --> 00:05:38.780 + Let's turn our attention a little bit to + performance. + + 92 + 00:05:38.810 --> 00:05:42.890 + We already mentioned that Cloudflare is a lot + more efficient than a traditional VPN. + + 93 + 00:05:42.920 --> 00:05:45.950 + Let's think about somebody in Germany trying + to access the wiki. + + 94 + 00:05:45.980 --> 00:05:48.680 + Cloudflare uses something called Anycast + networking, + + 95 + 00:05:48.680 --> 00:05:53.700 + which means that a request to the hostname + will resolve to the nearest Cloudflare data + + 96 + 00:05:53.700 --> 00:05:56.690 + center, of which we have many in over 300 + cities. + + 97 + 00:05:56.690 --> 00:06:00.620 + We also have 12,000 network peering + relationships, + + 98 + 00:06:00.620 --> 00:06:03.860 + allowing us to ensure fast connectivity from + user to application. + + 99 + 00:06:03.860 --> 00:06:09.140 + So our user in Germany might on ramp to + Cloudflare at a data center in Berlin, + + 100 + 00:06:09.140 --> 00:06:12.590 + whereas our Canadian user might on ramp in + Vancouver, + + 101 + 00:06:12.950 --> 00:06:17.930 + and their requests are authenticated and the + policy evaluated all close to the end user + + 102 + 00:06:17.930 --> 00:06:22.700 + and if authorized, their request is then + routed via the most efficient network path to + + 103 + 00:06:22.730 --> 00:06:25.777 + the Cloudflare data center that is then + nearest the application. + + 104 + 00:06:25.777 --> 00:06:28.910 + To further improve performance, + there are many more things we can do. + + 105 + 00:06:28.940 --> 00:06:33.140 + Any of Cloudflare's existing performance + services and network benefits apply to your + + 106 + 00:06:33.140 --> 00:06:37.040 + application traffic. So, + for example, we can leverage Cloudflare's + + 107 + 00:06:37.040 --> 00:06:41.150 + caching technologies so that any static data + from the wiki such as images, + + 108 + 00:06:41.150 --> 00:06:47.540 + files, videos is all cached locally at the + data center that the user is accessing. + + 109 + 00:06:47.540 --> 00:06:50.120 + Something your old VPN could never do. + + 110 + 00:06:50.150 --> 00:06:53.750 + Setting up access like this can be typically + done in less than an hour, + + 111 + 00:06:53.750 --> 00:06:58.010 + and it doesn't take long to migrate an entire + company's internal application + + 112 + 00:06:58.010 --> 00:07:03.470 + infrastructure. Unlike your VPN, + access to each application only exposes that + + 113 + 00:07:03.470 --> 00:07:08.120 + specific service. You don't need to worry + about firewalling off SSH and RDP, + + 114 + 00:07:08.150 --> 00:07:13.430 + because Cloudflare is only allowing access to + the specific application over HTTPS. + + 115 + 00:07:13.430 --> 00:07:18.920 + This is called network micro-segmentation and + really reduces concerns of access gained by + + 116 + 00:07:18.920 --> 00:07:23.840 + lateral movement. Changes to authentication + policies can easily be made in our dashboard + + 117 + 00:07:23.840 --> 00:07:27.530 + and in just a matter of seconds, + the entire global network is updated. + + 118 + 00:07:27.560 --> 00:07:28.940 + Well, thanks for watching. + + 119 + 00:07:28.940 --> 00:07:33.380 + This video is part of a series which explains + how to build your new corporate network using + + 120 + 00:07:33.380 --> 00:07:35.000 + Cloudflare SASE platform. + + 121 + 00:07:35.030 --> 00:07:37.430 + Watch the other videos in this series to + learn more. + + 122 + 00:07:39.440 --> 00:07:41.060 + Hi, I'm Simon from Cloudflare. + + 123 + 00:07:41.090 --> 00:07:42.620 + Congrats on finding this video. + + 124 + 00:07:42.620 --> 00:07:46.430 + We also cover a wide variety of topics + including application security, + + 125 + 00:07:46.430 --> 00:07:49.130 + corporate networking, + and all the developer content the Internet + + 126 + 00:07:49.130 --> 00:07:51.620 + can hold. Follow us online and thanks for + watching! \ No newline at end of file diff --git a/src/content/stream/sase-3-secure-remote-access/index.yaml b/src/content/stream/sase-3-secure-remote-access/index.yaml index 2efa307b7a81fcb..ab37beca899a136 100644 --- a/src/content/stream/sase-3-secure-remote-access/index.yaml +++ b/src/content/stream/sase-3-secure-remote-access/index.yaml @@ -14,4 +14,446 @@ chapters: { "Connecting User Devices Securely with Cloudflare's Device Agent": "03m01s", "Enforcing Access Control with Identity, Network and Device Based Security Policies": "03m48s", "Auditing and Logging Access to Critical Infrastructure": "05m03s" -} \ No newline at end of file +} +transcript: | + + WEBVTT + + 1 + 00:00:07.220 --> 00:00:14.450 + Secure Access Service Edge or SASE solutions + incorporate Zero Trust Network Access or ZTNA + + 2 + 00:00:14.660 --> 00:00:19.610 + to provide access to applications such as an + internal wiki or a HR system. + + 3 + 00:00:19.640 --> 00:00:25.190 + But what about critical high risk services + such as a database administration tool or + + 4 + 00:00:25.190 --> 00:00:28.070 + service requiring access via SSH or RDP? + + 5 + 00:00:28.370 --> 00:00:33.800 + In these cases, it's important to be able to + ensure tight security from the device all the + + 6 + 00:00:33.800 --> 00:00:39.020 + way to the application and allow authorized + users who are using strong authentication on + + 7 + 00:00:39.020 --> 00:00:44.240 + trusted devices. Let's say we need to secure + access to a database admin app such as + + 8 + 00:00:44.270 --> 00:00:47.810 + pgAdmin, a common web interface for Postgres + databases, + + 9 + 00:00:47.810 --> 00:00:50.360 + and also access to SSH on the same server. + + 10 + 00:00:50.390 --> 00:00:54.530 + Imagine we have an example environment, + and in it we've already created connectivity + + 11 + 00:00:54.560 --> 00:00:57.800 + from the server to Cloudflare, + using a software agent that maintains a + + 12 + 00:00:57.800 --> 00:01:02.230 + secure tunnel from the private network where + the Pgadmin server is running back to the + + 13 + 00:01:02.230 --> 00:01:06.700 + Cloudflare network. No private server IP + addresses are going to be exposed to the + + 14 + 00:01:06.700 --> 00:01:10.960 + Internet. We're essentially connecting this + server to our new corporate network managed + + 15 + 00:01:10.960 --> 00:01:15.400 + by Cloudflare. Once connected, + there are two methods by which we can access + + 16 + 00:01:15.400 --> 00:01:21.040 + our private server. Method one is to create a + public hostname which resolves to Cloudflare, + + 17 + 00:01:21.040 --> 00:01:25.150 + which in turn proxies and routes the traffic + for that specific hostname to that + + 18 + 00:01:25.150 --> 00:01:26.920 + application at the end of our tunnel. + + 19 + 00:01:26.950 --> 00:01:31.450 + And this method allows anyone, + anywhere, on any device to easily access the + + 20 + 00:01:31.450 --> 00:01:33.760 + application. But that's not enough. + + 21 + 00:01:33.760 --> 00:01:36.970 + In this scenario we want to implement even + tighter security. + + 22 + 00:01:36.970 --> 00:01:42.970 + So method two is to configure the tunnel to + proxy access only to the server IP with no + + 23 + 00:01:42.970 --> 00:01:48.340 + public DNS record, and only for trusted users + with managed devices that are connected to + + 24 + 00:01:48.370 --> 00:01:49.630 + the Cloudflare network. + + 25 + 00:01:49.630 --> 00:01:52.780 + So none of this server has any public + exposure. + + 26 + 00:01:53.830 --> 00:01:57.280 + Now, to provide access to only database + admins, + + 27 + 00:01:57.280 --> 00:01:59.260 + there are a few things we need to do. + + 28 + 00:01:59.290 --> 00:02:03.010 + We need to use an internal hostname that + resolves to our server. + + 29 + 00:02:03.040 --> 00:02:07.000 + We need to connect to the user device to the + Cloudflare managed network. + + 30 + 00:02:07.030 --> 00:02:12.640 + And we need to identify who the user is and + if their device has a good security posture. + + 31 + 00:02:12.670 --> 00:02:15.910 + So let's first look at how we do the internal + DNS resolution. + + 32 + 00:02:15.910 --> 00:02:20.860 + Because nobody likes using IP addresses to + access services with the exception of + + 33 + 00:02:20.860 --> 00:02:25.690 + 1.1.1.1, because it's the easiest IP address + on the Internet to remember. + + 34 + 00:02:25.690 --> 00:02:28.960 + So we really should always be using + hostnames. + + 35 + 00:02:29.110 --> 00:02:33.520 + With Cloudflare, it's as simple as connecting + a private DNS service to the network, + + 36 + 00:02:33.520 --> 00:02:37.630 + and then building a policy that says any + request from a user or a network, + + 37 + 00:02:37.630 --> 00:02:40.660 + anywhere on the Cloudflare network, + for an internal domain, + + 38 + 00:02:40.660 --> 00:02:43.540 + should be answered by that specific DNS + service. + + 39 + 00:02:43.570 --> 00:02:47.860 + In this example, we're going to connect it to + Cloudflare using exactly the same tunnel + + 40 + 00:02:47.860 --> 00:02:50.350 + software that we're using for the database + server. + + 41 + 00:02:50.380 --> 00:02:55.450 + So at this point we have our database admin + tool that's connected to Cloudflare and we + + 42 + 00:02:55.450 --> 00:03:00.770 + have an ability to resolve the IP address of + that private network using an internal + + 43 + 00:03:00.800 --> 00:03:05.720 + hostname. Next, we need to securely connect + the user device to Cloudflare so that all + + 44 + 00:03:05.720 --> 00:03:09.080 + traffic destined for our database server is + over secure channels. + + 45 + 00:03:09.110 --> 00:03:12.890 + We do this using a similar piece of software + we used on the server, + + 46 + 00:03:12.890 --> 00:03:15.080 + but one that's designed for user devices. + + 47 + 00:03:15.110 --> 00:03:20.030 + It supports macOS, windows, + Linux, iOS and Android and connects the + + 48 + 00:03:20.030 --> 00:03:22.370 + device to Cloudflare using a secure tunnel. + + 49 + 00:03:22.370 --> 00:03:26.000 + But the agent can actually provide + information about the security posture of the + + 50 + 00:03:26.000 --> 00:03:29.510 + device, and we'll talk about that later when + we look at the policy itself. + + 51 + 00:03:29.510 --> 00:03:32.180 + So once the user device is connected to + Cloudflare, + + 52 + 00:03:32.180 --> 00:03:36.710 + requests for private applications are + resolved using the internal DNS service, + + 53 + 00:03:36.710 --> 00:03:42.230 + and traffic is routed from the device through + Cloudflare through secure tunnels down to the + + 54 + 00:03:42.230 --> 00:03:44.540 + private IP the application is running on. + + 55 + 00:03:45.050 --> 00:03:48.710 + Now we have secured connectivity all the way + from the device to the server. + + 56 + 00:03:48.740 --> 00:03:53.600 + The last thing we need to do is actually + write a policy which enforces access only to + + 57 + 00:03:53.630 --> 00:03:57.290 + users that you authorize, + and that the device they're on meets a + + 58 + 00:03:57.290 --> 00:03:58.790 + certain level of security. + + 59 + 00:03:58.820 --> 00:04:03.690 + We use information from our device agent, + and also leverage your existing identity and + + 60 + 00:04:03.690 --> 00:04:06.000 + device services to help build that policy. + + 61 + 00:04:06.030 --> 00:04:09.690 + Cloudflare is typically integrated with one + or more identity providers. + + 62 + 00:04:09.690 --> 00:04:13.020 + Usually, your company has a central directory + for employees, + + 63 + 00:04:13.020 --> 00:04:14.370 + but you can also add more. + + 64 + 00:04:14.370 --> 00:04:17.460 + For example, you might manage contractors in + a different directory. + + 65 + 00:04:17.490 --> 00:04:22.260 + Cloudflare can also integrate with XDR + platforms such as CrowdStrike and + + 66 + 00:04:22.260 --> 00:04:27.150 + SentinelOne, and these give us information we + can use in the policy regards to the security + + 67 + 00:04:27.150 --> 00:04:31.170 + posture of the device, + such as if the device is free of malware. + + 68 + 00:04:31.200 --> 00:04:34.590 + For our own agent, we can provide information + about the device, + + 69 + 00:04:34.590 --> 00:04:38.190 + such as is the hard disk encrypted or if the + local firewall is enabled. + + 70 + 00:04:38.190 --> 00:04:40.680 + So now we have all the information about the + user, + + 71 + 00:04:40.680 --> 00:04:43.200 + their device, and how they're connected to + Cloudflare. + + 72 + 00:04:43.230 --> 00:04:47.880 + A policy can be created which only allows + users who have authenticated using a strong + + 73 + 00:04:47.910 --> 00:04:53.340 + factor, such as MFA using a hard token, + that they also exist in a group such as IT + + 74 + 00:04:53.370 --> 00:04:57.750 + administrators, and they're using a secure + device free of malware. + + 75 + 00:04:58.110 --> 00:05:03.390 + This policy sits in front of access to both + the database admin tool and the SSH service. + + 76 + 00:05:03.510 --> 00:05:07.410 + Finally, because you might want to record of + all access to the database administration + + 77 + 00:05:07.410 --> 00:05:13.020 + tool, you can optionally inject a page after + authentication asking for justification for + + 78 + 00:05:13.020 --> 00:05:16.170 + access to the app and that gets audited and + logged in Cloudflare. + + 79 + 00:05:16.170 --> 00:05:20.760 + So in summary, you've seen an example of how + Cloudflare can protect access to some of your + + 80 + 00:05:20.760 --> 00:05:24.000 + critical infrastructure using our SASE + platform. + + 81 + 00:05:24.000 --> 00:05:29.490 + We can help lock down access to servers only + from highly authenticated users on tightly + + 82 + 00:05:29.490 --> 00:05:34.020 + managed devices that must be connected to + your new corporate network or managed by + + 83 + 00:05:34.020 --> 00:05:36.510 + Cloudflare. Well, thanks for watching. + + 84 + 00:05:36.510 --> 00:05:41.250 + This video is part of a series which explains + how to build your new corporate network using + + 85 + 00:05:41.250 --> 00:05:42.900 + Cloudflare SASE platform. + + 86 + 00:05:42.930 --> 00:05:45.630 + You can watch the other videos in this series + to learn more. + + 87 + 00:05:47.400 --> 00:05:49.110 + Hi, I'm Simon from Cloudflare. + + 88 + 00:05:49.140 --> 00:05:50.700 + Congrats on finding this video! + + 89 + 00:05:50.700 --> 00:05:54.480 + We also cover a wide variety of topics + including application security, + + 90 + 00:05:54.480 --> 00:05:57.210 + corporate networking, + and all the developer content the Internet + + 91 + 00:05:57.210 --> 00:05:59.700 + can hold. Follow us online and thanks for + watching! \ No newline at end of file diff --git a/src/content/stream/sase-4-connect-secure/index.yaml b/src/content/stream/sase-4-connect-secure/index.yaml index eaf1799dccd454b..5f41f800c3b81b9 100644 --- a/src/content/stream/sase-4-connect-secure/index.yaml +++ b/src/content/stream/sase-4-connect-secure/index.yaml @@ -13,4 +13,512 @@ chapters: { "Enabling Secure Remote Access for Distributed Teams with Cloudflare's Zero Trust Approach": "02m47s", "Integrating Private Networks and Data Centers using various methods": "04m17s", "Cloudflare's Connectivity Cloud: Security, Performance, and Simplified Network Management": "05m17s" -} \ No newline at end of file +} +transcript: | + + WEBVTT + + 1 + 00:00:07.070 --> 00:00:10.970 + When looking at Secure Access Service Edge or + SASE platforms, + + 2 + 00:00:10.970 --> 00:00:15.260 + we often talk about a user getting remote + access into some privately hosted + + 3 + 00:00:15.260 --> 00:00:19.070 + application. The focus is often user to + application, + + 4 + 00:00:19.070 --> 00:00:21.830 + where the goal is network micro-segmentation, + + 5 + 00:00:21.830 --> 00:00:25.970 + and a user can only access an application + over a specific address and port. + + 6 + 00:00:26.000 --> 00:00:29.570 + But corporate networks exist to carry traffic + in many other ways. + + 7 + 00:00:29.600 --> 00:00:33.230 + Let's take, for example, + a retail coffee company with many coffee + + 8 + 00:00:33.230 --> 00:00:37.790 + shops each providing customers free access to + the Internet with their guest Wi-Fi, + + 9 + 00:00:37.790 --> 00:00:40.940 + but also connecting employees to internal + applications. + + 10 + 00:00:40.970 --> 00:00:45.200 + Each shop also houses point of sale devices, + security cameras, + + 11 + 00:00:45.200 --> 00:00:48.980 + and other network enabled equipment that need + access to the Internet, + + 12 + 00:00:48.980 --> 00:00:53.240 + but also might require access to other + private networks to back up data or be + + 13 + 00:00:53.240 --> 00:00:54.860 + monitored by internal tools. + + 14 + 00:00:54.890 --> 00:01:00.440 + IT staff also need to remotely access these + devices from a corporate office network. + + 15 + 00:01:00.470 --> 00:01:04.760 + A lot of this traffic is private and should + only remain on the corporate network. + + 16 + 00:01:04.790 --> 00:01:08.660 + This is where Cloudflare's Connectivity Cloud + really comes into its own. + + 17 + 00:01:08.690 --> 00:01:11.180 + The ability to mesh together different + networks, + + 18 + 00:01:11.180 --> 00:01:14.120 + applications and users no matter where they + are. + + 19 + 00:01:14.150 --> 00:01:17.180 + Let's dive deeper into our coffee company + example. + + 20 + 00:01:17.210 --> 00:01:20.630 + Right. First, they have their main + headquarters in Seattle. + + 21 + 00:01:20.630 --> 00:01:24.770 + Most HQ employees live locally and about half + travel into the office, + + 22 + 00:01:24.800 --> 00:01:26.870 + with the other half working remote at home. + + 23 + 00:01:27.080 --> 00:01:31.310 + Second, they have around 40 coffee shops down + the west coast of America, + + 24 + 00:01:31.340 --> 00:01:33.170 + each with a few employees in each. + + 25 + 00:01:33.170 --> 00:01:37.910 + And then they have an internal company wiki, + which is running in a virtual environment in + + 26 + 00:01:37.910 --> 00:01:41.150 + Amazon Web Services with its own virtual + private network. + + 27 + 00:01:41.150 --> 00:01:46.340 + And then finally, the security cameras at all + their coffee shops need to back up data to a + + 28 + 00:01:46.340 --> 00:01:52.310 + central service that you've got running on + servers that you run and host in a rack in a + + 29 + 00:01:52.310 --> 00:01:54.440 + data center in San Jose. + + 30 + 00:01:54.470 --> 00:01:57.890 + You see how these network locations are all + quite different. + + 31 + 00:01:57.950 --> 00:02:02.330 + Cloudflare has a variety of ways all these + networks can be connected together. + + 32 + 00:02:02.660 --> 00:02:05.960 + Let's start by connecting the headquarters + network in Seattle. + + 33 + 00:02:05.960 --> 00:02:10.640 + We can use something called Magic WAN, + which is our service that creates IPsec + + 34 + 00:02:10.670 --> 00:02:14.920 + tunnels from the headquarters office back to + the Cloudflare network and assign a private + + 35 + 00:02:14.950 --> 00:02:19.720 + network range to it. This is using regular + standard IPsec protocols and can easily + + 36 + 00:02:19.720 --> 00:02:22.630 + leverage functionality in a network, + router or firewall that exists at + + 37 + 00:02:22.630 --> 00:02:25.870 + headquarters. Next, let's look at each coffee + shop. + + 38 + 00:02:26.260 --> 00:02:31.600 + You can ship out to each location a physical + device running Cloudflare's Magic WAN + + 39 + 00:02:31.600 --> 00:02:35.830 + connector. It's essentially a lightweight + appliance that can be plugged into the local + + 40 + 00:02:35.830 --> 00:02:40.780 + ISP router. Each connector creates an IPsec + connection back to Cloudflare, + + 41 + 00:02:40.780 --> 00:02:45.340 + and each device can be administered remotely + via the Cloudflare dashboard private network. + + 42 + 00:02:45.340 --> 00:02:47.920 + Ranges can then be assigned to each coffee + shop. + + 43 + 00:02:47.920 --> 00:02:51.460 + And now we have the beginnings of a new + modern corporate network. + + 44 + 00:02:51.670 --> 00:02:56.920 + So IT admins in the Seattle office can now + remotely access point of sale devices in each + + 45 + 00:02:56.920 --> 00:03:00.850 + coffee shop location. Also, + because we want to provide customers in each + + 46 + 00:03:00.850 --> 00:03:03.670 + shop free Internet access using the guest + WiFi, + + 47 + 00:03:03.700 --> 00:03:06.580 + all traffic from that location is now routed + through Cloudflare, + + 48 + 00:03:06.580 --> 00:03:11.320 + and we can use our secure web gateway to + block any access to malicious websites, + + 49 + 00:03:11.320 --> 00:03:14.710 + and this keeps customers safe while they sip + their cappuccinos. + + 50 + 00:03:17.740 --> 00:03:20.230 + But what about the IT staff working from + home? + + 51 + 00:03:20.230 --> 00:03:23.110 + They're not connected to any of these + networks. No worries! + + 52 + 00:03:23.110 --> 00:03:26.050 + They can use our device agent, + which connects them to Cloudflare, + + 53 + 00:03:26.050 --> 00:03:29.680 + and in turn gives them access to this new + corporate network as if they were connected + + 54 + 00:03:29.680 --> 00:03:33.940 + in headquarters. Now it can manage the + devices in each coffee shop, + + 55 + 00:03:33.940 --> 00:03:36.820 + no matter if they're on a plane, + sitting in an office, + + 56 + 00:03:36.820 --> 00:03:41.650 + or in a coffee shop. When each network or + user connects, + + 57 + 00:03:41.650 --> 00:03:44.590 + it does so to the nearest Cloudflare data + center, + + 58 + 00:03:44.590 --> 00:03:50.290 + which is a key feature of our network where + we use Anycast IP networking to ensure secure + + 59 + 00:03:50.320 --> 00:03:55.540 + connections to users and offices are made to + the geographically nearest Cloudflare data + + 60 + 00:03:55.570 --> 00:04:00.610 + center, so that traffic is then secured and + optimized as close as possible to the user or + + 61 + 00:04:00.610 --> 00:04:06.760 + to that network. And we have data centers in + over 300 cities and have over 12,000 network + + 62 + 00:04:06.790 --> 00:04:10.360 + peering relationships, + allowing us to ensure fast connectivity from + + 63 + 00:04:10.360 --> 00:04:14.410 + user to the network. Think of it like having + a coffee shop in every neighborhood so + + 64 + 00:04:14.410 --> 00:04:16.960 + everyone doesn't have to walk far to get a + cup of coffee. + + 65 + 00:04:17.830 --> 00:04:19.450 + But what about those camera backups? + + 66 + 00:04:19.450 --> 00:04:23.200 + Remember, the backup service is running in a + data center in San Jose. + + 67 + 00:04:23.230 --> 00:04:28.120 + Most likely than not. Cloudflare is also + running our own servers in the same data + + 68 + 00:04:28.150 --> 00:04:33.250 + center, and you can offer direct connections + from Cloudflare to your network switches, + + 69 + 00:04:33.250 --> 00:04:35.410 + further extending your corporate network. + + 70 + 00:04:35.410 --> 00:04:38.470 + And even if your servers are not in the exact + same data center, + + 71 + 00:04:38.470 --> 00:04:42.610 + we can create a virtual connection directly + from your rack to the nearest Cloudflare data + + 72 + 00:04:42.640 --> 00:04:45.340 + center. Now we've got everything connected. + + 73 + 00:04:45.370 --> 00:04:47.290 + Let's add a new application into the mix. + + 74 + 00:04:47.290 --> 00:04:50.380 + Let's say the company is launching a new + internal company wiki, + + 75 + 00:04:50.380 --> 00:04:54.220 + and they're running the service in AWS, + Amazon Web Services. + + 76 + 00:04:54.220 --> 00:04:57.640 + We don't need to connect the entire AWS + private network. + + 77 + 00:04:57.640 --> 00:05:02.590 + We just install a software agent on the wiki + server that creates a secure tunnel back to + + 78 + 00:05:02.620 --> 00:05:05.890 + Cloudflare, and connects that application to + the network, + + 79 + 00:05:05.920 --> 00:05:10.390 + that anyone on that network can now access + the application policies and Cloudflare + + 80 + 00:05:10.390 --> 00:05:14.320 + control who can access the wiki, + ensuring users authenticate with valid + + 81 + 00:05:14.320 --> 00:05:16.360 + credentials and are using secured devices. + + 82 + 00:05:16.360 --> 00:05:19.930 + You can see that Cloudflare is able to + connect to a wide variety of networks, + + 83 + 00:05:19.930 --> 00:05:24.430 + from the physical office locations to virtual + application networks in the cloud, + + 84 + 00:05:24.430 --> 00:05:27.580 + as well as direct your servers running in + your data centers. + + 85 + 00:05:27.580 --> 00:05:32.730 + So much of the complexity from legacy network + architectures is abstracted into our + + 86 + 00:05:32.730 --> 00:05:36.840 + Connectivity Cloud , making life much easier + for IT and network admins. + + 87 + 00:05:36.870 --> 00:05:41.040 + And once connected to Cloudflare, + it's not just about routing traffic. + + 88 + 00:05:41.040 --> 00:05:45.660 + Firewalling, DNS, Load Balancing, + protecting from denial of service attacks, + + 89 + 00:05:45.660 --> 00:05:49.440 + content caching, and a lot more are all + easily enabled. + + 90 + 00:05:49.440 --> 00:05:53.760 + Any traffic destined for the Internet can + also be filtered to ensure only access to + + 91 + 00:05:53.790 --> 00:05:57.540 + legitimate sites, and blocking any unsafe + transfer of company data. + + 92 + 00:05:57.570 --> 00:06:01.890 + The flexibility of Cloudflare's Connectivity + Cloud allows you to connect all sorts of + + 93 + 00:06:01.890 --> 00:06:03.540 + networks and applications and users. + + 94 + 00:06:03.540 --> 00:06:08.070 + It's possible to recreate your classic + corporate network and then apply on top of it + + 95 + 00:06:08.070 --> 00:06:13.320 + all the modern Zero Trust services to ensure + high security without compromising the user + + 96 + 00:06:13.320 --> 00:06:15.360 + experience. Well, thanks for watching. + + 97 + 00:06:15.360 --> 00:06:19.590 + This video is part of a series which explains + how to build your new corporate network using + + 98 + 00:06:19.590 --> 00:06:21.330 + Cloudflare SaaS platform. + + 99 + 00:06:21.360 --> 00:06:23.670 + Watch the other videos in this series to + learn more. + + 100 + 00:06:25.590 --> 00:06:27.150 + Hi, I'm Simon from Cloudflare. + + 101 + 00:06:27.180 --> 00:06:28.710 + Congrats on finding this video. + + 102 + 00:06:28.710 --> 00:06:32.520 + We also cover a wide variety of topics + including application security, + + 103 + 00:06:32.520 --> 00:06:35.250 + corporate networking, + and all the developer content the Internet + + 104 + 00:06:35.250 --> 00:06:37.680 + can hold. Follow us online and thanks for + watching! \ No newline at end of file diff --git a/src/content/stream/sase-5-protect-users/index.yaml b/src/content/stream/sase-5-protect-users/index.yaml index 815467dc367f12b..75a4de371c0dc3d 100644 --- a/src/content/stream/sase-5-protect-users/index.yaml +++ b/src/content/stream/sase-5-protect-users/index.yaml @@ -14,4 +14,591 @@ chapters: { "Implementing Network-Level Security Policies for Private and Public Traffic": "03m37s", "Advanced HTTP Filtering and Data Loss Prevention with Cloudflare": "04m23s", "Isolating Risky Websites and Preventing Data Leaks with Browser Isolation": "05m48s" -} \ No newline at end of file +} +transcript: | + + WEBVTT + + 1 + 00:00:07.100 --> 00:00:11.540 + Cloudflare's Connectivity Cloud hosts a + complete Secure Access Service Edge, + + 2 + 00:00:11.540 --> 00:00:16.790 + or SASE platform, which allows organizations + to create a new corporate network leveraging + + 3 + 00:00:16.790 --> 00:00:20.930 + the latest in zero trust security approaches + and cloud based networking. + + 4 + 00:00:21.110 --> 00:00:24.320 + Many companies start by connecting + applications, + + 5 + 00:00:24.350 --> 00:00:28.970 + networks and user devices to Cloudflare to + use Zero Trust Network Access, + + 6 + 00:00:28.970 --> 00:00:33.800 + or ZTNA to authorize users to connect to + self-hosted applications and private + + 7 + 00:00:33.830 --> 00:00:39.560 + networks. But connecting devices and networks + into Cloudflare can also help secure public + + 8 + 00:00:39.560 --> 00:00:43.130 + Internet access and increase visibility and + control over company data. + + 9 + 00:00:43.160 --> 00:00:47.240 + Let's take a look at an example of a company + that has already connected its corporate HQ + + 10 + 00:00:47.240 --> 00:00:51.800 + network, along with a few branch offices and + many remote user devices. + + 11 + 00:00:51.800 --> 00:00:56.780 + You can see that all these methods of on + ramping traffic to Cloudflare result in user + + 12 + 00:00:56.780 --> 00:00:58.940 + traffic flowing through our network. + + 13 + 00:00:58.960 --> 00:01:02.740 + Sometimes the traffic is destined for a + private application or network, + + 14 + 00:01:02.740 --> 00:01:06.370 + but a lot of the traffic is just heading for + the public Internet. + + 15 + 00:01:06.400 --> 00:01:10.810 + Cloudflare has the ability to inspect that + traffic using another part of our SASE + + 16 + 00:01:10.810 --> 00:01:13.570 + platform, the Secure Web Gateway. + + 17 + 00:01:13.600 --> 00:01:16.420 + It can examine traffic either at the DNS + request, + + 18 + 00:01:16.420 --> 00:01:21.070 + the network level, or we can even inspect the + contents of a HTTP request. + + 19 + 00:01:21.850 --> 00:01:26.020 + Do you want to deny users from accessing + websites known to be part of a phishing + + 20 + 00:01:26.020 --> 00:01:29.770 + campaign or ransomware attack, + or only allow users coming from IP addresses + + 21 + 00:01:29.770 --> 00:01:32.140 + in the US to access your Workday instance? + + 22 + 00:01:32.140 --> 00:01:36.970 + Or more seriously, do you want to prevent + employees from sending sensitive information + + 23 + 00:01:36.970 --> 00:01:41.050 + like financial data or source code to AI + sites like ChatGPT? + + 24 + 00:01:41.140 --> 00:01:43.990 + Policies in the Secure Web Gateway allow you + to achieve this, + + 25 + 00:01:43.990 --> 00:01:46.780 + and they can be written using a wide variety + of attributes. + + 26 + 00:01:46.780 --> 00:01:50.800 + We can even isolate a website by running not + in the user's browser, + + 27 + 00:01:50.800 --> 00:01:54.460 + but by rendering it in our headless browser, + running on our own network. + + 28 + 00:01:54.460 --> 00:01:56.740 + And then we send the results down to the user + device, + + 29 + 00:01:56.740 --> 00:02:00.670 + and this protects them from any nasty code + running in that website. + + 30 + 00:02:00.700 --> 00:02:03.970 + Let's take a look at the different ways our + Secure Web Gateway can help protect your + + 31 + 00:02:03.970 --> 00:02:08.350 + organization. The first method to protect any + user or device is to look at their DNS + + 32 + 00:02:08.350 --> 00:02:12.940 + requests. Some of the most common policies + are simply designed to prevent access to + + 33 + 00:02:12.970 --> 00:02:14.680 + known high risk websites. + + 34 + 00:02:14.680 --> 00:02:18.910 + To make your life easier, + Cloudflare manages large lists of sites that + + 35 + 00:02:18.910 --> 00:02:20.140 + are known to be dangerous. + + 36 + 00:02:20.140 --> 00:02:23.380 + Either they've been found to distribute + malware or they're part of a phishing + + 37 + 00:02:23.380 --> 00:02:27.730 + campaign. All you need to do is include that + category in the deny policy, + + 38 + 00:02:27.730 --> 00:02:29.830 + and users will be blocked from visiting them. + + 39 + 00:02:29.830 --> 00:02:32.950 + Cloudflare keeps the sites in each category + up to date. + + 40 + 00:02:32.950 --> 00:02:38.260 + In fact, we block an average of 158 billion + cyber threats a day. + + 41 + 00:02:38.260 --> 00:02:41.710 + So we have an amazing view into what's bad + out there on the Internet. + + 42 + 00:02:41.710 --> 00:02:44.500 + You could never maintain this amount of data + yourself. + + 43 + 00:02:44.530 --> 00:02:48.820 + Policies can be applied at the user level or + be based on network location. + + 44 + 00:02:48.820 --> 00:02:52.870 + You might wish to implement a policy that + limits certain websites depending on the + + 45 + 00:02:52.870 --> 00:02:54.850 + country the network request is coming from. + + 46 + 00:02:54.850 --> 00:02:59.580 + You can even subscribe to government cyber + defense lists of known malicious websites. + + 47 + 00:03:00.510 --> 00:03:05.250 + You can also use a DNS policy to simplify + some of your IT infrastructure. + + 48 + 00:03:05.280 --> 00:03:10.320 + A policy can override the IP address returned + from a DNS request and point to a service + + 49 + 00:03:10.320 --> 00:03:15.450 + that might be local. For example, + you might configure all employee laptops to + + 50 + 00:03:15.480 --> 00:03:18.300 + use a single hostname for connecting to the + office printer. + + 51 + 00:03:18.330 --> 00:03:21.150 + Let's say it's printer dot company dot local. + + 52 + 00:03:21.180 --> 00:03:24.720 + Then, if a user is attempting to print in the + Seattle office, + + 53 + 00:03:24.750 --> 00:03:29.400 + Cloudflare will replace the IP address for + that host with the local office printer. + + 54 + 00:03:29.400 --> 00:03:32.100 + But if the same user then travels to the + London office, + + 55 + 00:03:32.100 --> 00:03:36.258 + the same laptop makes the same request to + print and Cloudflare replaces the IP address + + 56 + 00:03:36.258 --> 00:03:37.410 + now for the London printer. + + 57 + 00:03:37.440 --> 00:03:40.800 + The second method of protection is by using + network policies. + + 58 + 00:03:40.800 --> 00:03:43.890 + So for all your networks connected Cloudflare + SASE platform, + + 59 + 00:03:43.890 --> 00:03:47.280 + it's possible to write simple + firewall-like-rules. + + 60 + 00:03:47.370 --> 00:03:52.200 + These are often used to allow access to + specific services on private IP addresses. + + 61 + 00:03:52.230 --> 00:03:56.160 + Say for example, you have a lot of windows + servers running in your corporate network and + + 62 + 00:03:56.160 --> 00:03:59.760 + you want to ensure only IT admins are allowed + to connect to them over RDP. + + 63 + 00:04:00.330 --> 00:04:05.160 + How? Well, when users access Cloudflare using + our device agent, + + 64 + 00:04:05.190 --> 00:04:09.330 + network access policies can use identity + information such as the method of + + 65 + 00:04:09.330 --> 00:04:12.990 + authentication, what groups the user is in as + part of the policy. + + 66 + 00:04:13.020 --> 00:04:16.350 + Device security posture can also be taken + from that device agent, + + 67 + 00:04:16.350 --> 00:04:21.480 + making sure that IT admins access Windows + servers only using secured company managed + + 68 + 00:04:21.480 --> 00:04:27.660 + devices. The third and the one with the most + control is HTTP policies, + + 69 + 00:04:27.660 --> 00:04:31.260 + since it allows you to inspect the actual + HTTP traffic. + + 70 + 00:04:31.320 --> 00:04:34.500 + For devices where a Cloudflare certificate + has been deployed, + + 71 + 00:04:34.500 --> 00:04:38.070 + the TLS and SSL connection terminates at + Cloudflare, + + 72 + 00:04:38.070 --> 00:04:41.520 + where you can inspect the traffic and apply + your policies. + + 73 + 00:04:41.670 --> 00:04:45.900 + You can build policies that limit the + uploading or downloading of files based on + + 74 + 00:04:45.930 --> 00:04:52.220 + their file type, or prevent HTTP POST or PUT + to prevent the certain upload of content to + + 75 + 00:04:52.250 --> 00:04:57.890 + any websites. We also have a sandboxing + feature where we can use AV scanning to + + 76 + 00:04:57.920 --> 00:05:02.060 + examine certain files being downloaded and + quarantine them if they contain malicious + + 77 + 00:05:02.060 --> 00:05:07.880 + content. But the true power of inspecting + HTTP traffic is when it's combined with our + + 78 + 00:05:07.880 --> 00:05:12.410 + DLP policies. Here, we can match any part of + the HTTP request, + + 79 + 00:05:12.410 --> 00:05:16.610 + either the body of the request or if a file + contains specific content, + + 80 + 00:05:16.610 --> 00:05:21.260 + and then protect that data from leaving your + organization or being downloaded to insecure + + 81 + 00:05:21.290 --> 00:05:25.250 + devices. We have built-in DLP profiles for + matching common data, + + 82 + 00:05:25.280 --> 00:05:29.480 + such as health or financial information, + source code or privately identifiable + + 83 + 00:05:29.480 --> 00:05:32.960 + information such as social security or tax + identifiers. + + 84 + 00:05:32.990 --> 00:05:38.390 + You can also create your own DLP profiles by + either defining patterns to match sensitive + + 85 + 00:05:38.390 --> 00:05:42.140 + data, or just by uploading a list of known + customer accounts. + + 86 + 00:05:42.170 --> 00:05:46.700 + Now, when users attempt to download or upload + any content that matches these profiles, + + 87 + 00:05:46.700 --> 00:05:48.530 + you have the ability to block it. + + 88 + 00:05:48.530 --> 00:05:51.460 + Sometimes the risk for a website isn't well + known. + + 89 + 00:05:51.490 --> 00:05:55.150 + For example, you might deem social media + websites to be a little risky, + + 90 + 00:05:55.150 --> 00:05:58.030 + but your marketing department still requires + access. + + 91 + 00:05:58.060 --> 00:06:01.900 + Newly registered domains might sometimes be + part of a phishing campaign, + + 92 + 00:06:01.900 --> 00:06:04.300 + or they might just be a legitimate new + website. + + 93 + 00:06:04.330 --> 00:06:07.990 + In these examples, Cloudflare has a really + cool capability. + + 94 + 00:06:08.020 --> 00:06:13.360 + You can write a policy that when a user makes + a request for a website you think is a little + + 95 + 00:06:13.360 --> 00:06:16.960 + risky, instead of their machine receiving all + the content directly, + + 96 + 00:06:16.960 --> 00:06:21.250 + we spin up a headless browser on our network + and render the content first. + + 97 + 00:06:21.280 --> 00:06:25.090 + Here we isolate any potential bad behavior in + a secure, + + 98 + 00:06:25.120 --> 00:06:29.680 + isolated environment. We then send the + results of the render page down to the user's + + 99 + 00:06:29.680 --> 00:06:33.820 + device, and you can optionally turn on and + off certain capabilities, + + 100 + 00:06:33.820 --> 00:06:37.660 + such as the ability to enter text into the + web page or download files. + + 101 + 00:06:37.690 --> 00:06:40.600 + We call this Remote Browser Isolation. + + 102 + 00:06:40.780 --> 00:06:45.580 + You can also use this service to limit access + to SaaS application data for a certain set of + + 103 + 00:06:45.580 --> 00:06:49.510 + users. You might, for example, + want to allow contractors or partners to have + + 104 + 00:06:49.510 --> 00:06:53.410 + access to your Salesforce instance, + and you can use our Browser Isolation to + + 105 + 00:06:53.440 --> 00:06:56.830 + prevent copy and paste, + printing or downloading of Salesforce data. + + 106 + 00:06:56.860 --> 00:07:01.330 + So in summary, Cloudflare has a powerful + range of capabilities to protect users from + + 107 + 00:07:01.330 --> 00:07:05.980 + the threat of bad actors on the Internet, + while also identifying company data and + + 108 + 00:07:05.980 --> 00:07:10.720 + protecting its use. You can ensure safe + browsing by blocking known malicious + + 109 + 00:07:10.720 --> 00:07:15.190 + websites, detect when company data is being + uploaded to unapproved cloud storage, + + 110 + 00:07:15.190 --> 00:07:17.350 + or downloaded to insecure devices. + + 111 + 00:07:17.350 --> 00:07:22.030 + You can even isolate the entire website so + that users are protected from any dangerous + + 112 + 00:07:22.060 --> 00:07:24.400 + activity. Well, thanks for watching! + + 113 + 00:07:24.400 --> 00:07:28.750 + This video is part of a series which explains + how to build your new corporate network using + + 114 + 00:07:28.750 --> 00:07:30.340 + Cloudflare SASE platform. + + 115 + 00:07:30.370 --> 00:07:32.740 + Watch the other videos in this series to + learn more. + + 116 + 00:07:34.630 --> 00:07:36.310 + Hi, I'm Simon from Cloudflare. + + 117 + 00:07:36.340 --> 00:07:37.900 + Congrats on finding this video! + + 118 + 00:07:37.900 --> 00:07:41.680 + We also cover a wide variety of topics + including application security, + + 119 + 00:07:41.680 --> 00:07:44.410 + corporate networking, + and all the developer content the Internet + + 120 + 00:07:44.410 --> 00:07:46.960 + can hold. Follow us online and thanks for + watching! \ No newline at end of file diff --git a/src/content/stream/warp-1-basics/index.yaml b/src/content/stream/warp-1-basics/index.yaml index 754cb6f7892a975..932beaacb9f9c1e 100644 --- a/src/content/stream/warp-1-basics/index.yaml +++ b/src/content/stream/warp-1-basics/index.yaml @@ -14,4 +14,381 @@ chapters: { "WARP Operating Modes": "02m12s", "Split Tunneling": "03m4s", "Conclusion": "04m56s" -} \ No newline at end of file +} +transcript: | + + WEBVTT + + STYLE + ::cue(v[voice="Speaker1"]) { color: white } + + 1 + 00:00:04.240 --> 00:00:06.200 + Hi, I'm Jess from Cloudflare. + + 2 + 00:00:06.240 --> 00:00:10.200 + Welcome. In this video, + you'll learn the basics of Cloudflare WARP. + + 3 + 00:00:10.240 --> 00:00:12.480 + Our support team will always be here to help, + + 4 + 00:00:12.480 --> 00:00:17.240 + but this guide is all about empowering you to + understand and solve issues faster on your + + 5 + 00:00:17.240 --> 00:00:22.120 + own. We will learn the Cloudflare WARP client + and how it differs from the consumer version + + 6 + 00:00:22.120 --> 00:00:27.240 + of WARP, also known as the app 1.1.1.1, + device profiles, + + 7 + 00:00:27.520 --> 00:00:32.800 + the different operating modes of WARP, + split tunneling exclude versus include modes, + + 8 + 00:00:32.960 --> 00:00:36.000 + and the WARP GUI and its intended versus + actual state. + + 9 + 00:00:36.560 --> 00:00:40.360 + These are the basic concepts that will + prepare you to troubleshoot any issues you + + 10 + 00:00:40.360 --> 00:00:44.640 + may encounter. Let's get started with What is + the Cloudflare WARP client? + + 11 + 00:00:45.040 --> 00:00:49.920 + Cloudflare WARP client allows you to protect + corporate devices by securely and privately + + 12 + 00:00:49.920 --> 00:00:53.800 + sending traffic from those devices to + Cloudflare's global network, + + 13 + 00:00:54.040 --> 00:00:57.120 + where Cloudflare Gateway can apply advanced + web filtering. + + 14 + 00:00:57.440 --> 00:01:00.800 + The consumer version of WARP, + or the app 1.1.1.1, + + 15 + 00:01:00.800 --> 00:01:02.640 + is available to the public for free. + + 16 + 00:01:03.140 --> 00:01:06.220 + The corporate version integrates with + Cloudflare Zero Trust, + + 17 + 00:01:06.380 --> 00:01:09.940 + giving your IT team the ability to manage + security policies, + + 18 + 00:01:10.180 --> 00:01:12.940 + control traffic routing, + and monitor usage. + + 19 + 00:01:13.060 --> 00:01:16.100 + If you're not sure which version of WARP + you're currently using, + + 20 + 00:01:16.100 --> 00:01:18.620 + you can tell them apart easily by its color. + + 21 + 00:01:19.020 --> 00:01:21.820 + The consumer version will display WARP in + red, + + 22 + 00:01:21.980 --> 00:01:25.220 + whereas the corporate version will display + Zero Trust in blue. + + 23 + 00:01:25.740 --> 00:01:28.500 + If your intention is to use the corporate + version, + + 24 + 00:01:28.660 --> 00:01:32.900 + make sure you're seeing a blue Zero Trust + WARP banner by authenticating with your + + 25 + 00:01:32.900 --> 00:01:35.020 + Cloudflare Zero Trust organization. + + 26 + 00:01:35.300 --> 00:01:37.620 + Next, what is the device profile? + + 27 + 00:01:37.940 --> 00:01:42.380 + A device profile represents a different set + of parameters assigned to your device, + + 28 + 00:01:42.380 --> 00:01:45.220 + based on its relationship with the policy + attributes. + + 29 + 00:01:45.220 --> 00:01:49.540 + You can create multiple profiles and apply + different settings based on your user's + + 30 + 00:01:49.540 --> 00:01:53.140 + identity, the device location, + and other criteria. + + 31 + 00:01:53.180 --> 00:01:57.140 + IT administrators can assign different device + profiles to their users. + + 32 + 00:01:57.540 --> 00:02:01.220 + For example, depending on office locations, + teams, + + 33 + 00:02:01.220 --> 00:02:05.100 + device types, operating systems, + or other attributes, + + 34 + 00:02:05.310 --> 00:02:09.230 + users might have different routes that need + to be excluded from their WARP Tunnel, + + 35 + 00:02:09.470 --> 00:02:13.070 + or different DNS settings to accommodate + local development services. + + 36 + 00:02:16.070 --> 00:02:20.470 + All right, it's important to know that WARP + client can operate in different modes, + + 37 + 00:02:20.470 --> 00:02:24.390 + because each mode controls the types of + traffic sent to Cloudflare Gateway + + 38 + 00:02:24.390 --> 00:02:29.430 + differently. The WARP mode determines which + Zero Trust features are available on the + + 39 + 00:02:29.430 --> 00:02:33.590 + device. Selecting the right mode depends on + your organization's needs. + + 40 + 00:02:33.870 --> 00:02:39.520 + For example, for Internet security or remote + access gateway with WARP or Secure Web + + 41 + 00:02:39.520 --> 00:02:42.110 + Gateway without DNS filtering would be ideal, + + 42 + 00:02:42.910 --> 00:02:47.470 + and the latter should only be used in cases + where Cloudflare cannot control DNS + + 43 + 00:02:47.470 --> 00:02:49.110 + resolution on the device. + + 44 + 00:02:49.590 --> 00:02:53.550 + Both Gateway with DoH and Proxy Mode are used + for Internet filtering. + + 45 + 00:02:54.150 --> 00:02:59.710 + Gateway with DoH is only DNS traffic, + while Proxy Mode is only HTTP traffic. + + 46 + 00:02:59.870 --> 00:03:05.150 + Lastly, Device Information Only mode would be + useful for clientless access or browser based + + 47 + 00:03:05.150 --> 00:03:09.530 + remote access to use device posture without + proxying traffic to Cloudflare. + + 48 + 00:03:09.570 --> 00:03:13.050 + If you encounter a problem, + understanding which mode you're in will help + + 49 + 00:03:13.050 --> 00:03:15.050 + you narrow down where the problem might be. + + 50 + 00:03:15.210 --> 00:03:19.290 + And that's because WARP modes are + combinations or absences of particular + + 51 + 00:03:19.290 --> 00:03:24.250 + features. For example, + Gateway with WARP includes both DNS and + + 52 + 00:03:24.250 --> 00:03:26.810 + Tunnel components. So when you're + troubleshooting, + + 53 + 00:03:26.810 --> 00:03:31.770 + you have to look at both the DNS and Tunnel + components as opposed to Gateway with DoH + + 54 + 00:03:32.090 --> 00:03:34.890 + where you will only have to look at the DNS + component. + + 55 + 00:03:35.170 --> 00:03:38.050 + But don't worry, you don't have to memorize + all of this. + + 56 + 00:03:38.050 --> 00:03:40.410 + You can always refer to our documentation. + + 57 + 00:03:40.450 --> 00:03:45.730 + Next up, split tunneling, + a feature that allows you to control what IP + + 58 + 00:03:45.770 --> 00:03:48.850 + traffic goes through the WARP virtual + interface or tunnel. + + 59 + 00:03:49.090 --> 00:03:50.730 + There are two ways to configure it. + + 60 + 00:03:52.170 --> 00:03:55.010 + The first mode is exclude IPs and domains. + + 61 + 00:03:55.170 --> 00:03:56.730 + This is the default setting. + + 62 + 00:03:57.090 --> 00:04:01.330 + All traffic will be sent to Cloudflare + Gateway except for IPs and domains you + + 63 + 00:04:01.330 --> 00:04:05.970 + specify. The second mode is include IPs and + domains. + + 64 + 00:04:06.290 --> 00:04:11.300 + Only traffic destined to IPs or domains you + specify will be sent to Cloudflare Gateway. + + 65 + 00:04:11.780 --> 00:04:16.700 + All other traffic will bypass Gateway and + will no longer be filtered by your network or + + 66 + 00:04:16.740 --> 00:04:22.340 + HTTP policies. Secure Web Gateway without DNS + filtering and Device Information Only mode + + 67 + 00:04:22.340 --> 00:04:25.420 + will automatically disable domain based split + tunneling. + + 68 + 00:04:25.420 --> 00:04:28.180 + So if you're experiencing issues related to + domains, + + 69 + 00:04:28.180 --> 00:04:30.100 + it's good to check your WARP mode. + + 70 + 00:04:30.340 --> 00:04:33.380 + And lastly, here's a common point of + confusion. + + 71 + 00:04:33.620 --> 00:04:36.940 + The toggle button in the WARP GUI shows the + intended state, + + 72 + 00:04:36.980 --> 00:04:41.060 + not the actual state. For example, + if the toggle is on, + + 73 + 00:04:41.100 --> 00:04:46.140 + it means that the client intends to connect, + but the actual status may show disconnected + + 74 + 00:04:46.140 --> 00:04:51.100 + if there's an issue. So always check the + message below the toggle for the current + + 75 + 00:04:51.100 --> 00:04:55.900 + connection state. You now understand the + foundation of WARP client components. + + 76 + 00:04:55.900 --> 00:04:59.140 + If you want to learn more, + we also have additional resources on + + 77 + 00:04:59.140 --> 00:05:02.380 + Cloudflare docs. Thanks for watching and see + you soon! \ No newline at end of file diff --git a/src/content/stream/warp-2-diagonostic-logs/index.yaml b/src/content/stream/warp-2-diagonostic-logs/index.yaml index 6afdc145a1f9ccd..e642ac967a12a81 100644 --- a/src/content/stream/warp-2-diagonostic-logs/index.yaml +++ b/src/content/stream/warp-2-diagonostic-logs/index.yaml @@ -16,4 +16,637 @@ chapters: { "daemonlog": "03m37s", "Additonal tips": "08m07s", "Conclusion": "08m43s" -} \ No newline at end of file +} +transcript: | + + WEBVTT + + STYLE + ::cue(v[voice="Speaker1"]) { color: white } + + 1 + 00:00:07.360 --> 00:00:09.280 + Hi, I'm Jess from Cloudflare. + + 2 + 00:00:09.440 --> 00:00:14.320 + Welcome. This is a WARP troubleshooting video + where you'll learn how to interpret warp-diag + + 3 + 00:00:14.640 --> 00:00:19.600 + files. This is a more advanced episode, + so if you come across any concepts you aren't + + 4 + 00:00:19.600 --> 00:00:24.560 + fully familiar with, we also have a WARP + basics video that brings you up to speed. + + 5 + 00:00:24.680 --> 00:00:27.520 + And as always, our support team will be here + to help. + + 6 + 00:00:27.720 --> 00:00:29.160 + Here's what we will go through. + + 7 + 00:00:29.560 --> 00:00:31.200 + What are warp-diag files? + + 8 + 00:00:31.640 --> 00:00:34.360 + How to download and navigate the warp-diag + files, + + 9 + 00:00:35.000 --> 00:00:39.920 + warp-status file, warp-settings file, + daemon.log file, + + 10 + 00:00:39.920 --> 00:00:42.440 + and a few additional tips for analyzing them. + + 11 + 00:00:42.800 --> 00:00:50.680 + Let's get started. So what are warp-diag + files? + + 12 + 00:00:51.040 --> 00:00:55.120 + They contain valuable information about the + device connection status, + + 13 + 00:00:55.120 --> 00:00:57.520 + configuration, and WARP logs. + + 14 + 00:00:57.880 --> 00:01:01.920 + These files are your first line of defense + when troubleshooting any issues. + + 15 + 00:01:02.830 --> 00:01:07.390 + Each of these files serves different purposes + and contains specific information, + + 16 + 00:01:07.390 --> 00:01:11.670 + such as combination of logs and outputs + created when warp-diag runs. + + 17 + 00:01:17.510 --> 00:01:19.990 + Now where are the WARP files? + + 18 + 00:01:20.350 --> 00:01:24.270 + When WARP is installed, + a command line tool called warp-diag is also + + 19 + 00:01:24.270 --> 00:01:30.270 + installed. Simply running the command + warp-diag in a terminal will generate a zip + + 20 + 00:01:30.270 --> 00:01:32.830 + file and place it on the user's desktop. + + 21 + 00:01:33.270 --> 00:01:37.510 + Each time warp-diag is run, + a new set of logs will be generated, + + 22 + 00:01:37.510 --> 00:01:42.710 + and now we can start by unzipping the file + produced by warp-diag and opening its content + + 23 + 00:01:42.710 --> 00:01:48.510 + in a text editor. I'm using VS Code here, + but any other text editor will also work. + + 24 + 00:01:48.870 --> 00:01:53.190 + In this video, we'll only look at three + particularly useful ones for initial + + 25 + 00:01:53.190 --> 00:01:57.030 + troubleshooting: warp-status, + warp-settings, + + 26 + 00:01:57.150 --> 00:02:02.190 + and daemon.log. So now I'll walk you through + each of these files and tell you why they're + + 27 + 00:02:02.190 --> 00:02:04.190 + useful for troubleshooting. + + 28 + 00:02:09.180 --> 00:02:11.620 + First, let's take a look at warp-status. + + 29 + 00:02:12.020 --> 00:02:13.620 + This file is straightforward. + + 30 + 00:02:13.620 --> 00:02:17.100 + It contains the status of the client when + warp-diag was executed. + + 31 + 00:02:17.300 --> 00:02:21.780 + The connection status is useful to know when + you're analyzing any files that are outputs + + 32 + 00:02:21.780 --> 00:02:25.340 + of common command line tools such as listing + interfaces, + + 33 + 00:02:25.460 --> 00:02:28.620 + printing the routing table, + and current DNS configuration. + + 34 + 00:02:28.820 --> 00:02:31.020 + And that's it! On to warp- + settings. + + 35 + 00:02:32.860 --> 00:02:37.660 + This file contains all of the currently + active settings configured for the device, + + 36 + 00:02:37.660 --> 00:02:39.820 + such as the modes and device profile. + + 37 + 00:02:40.500 --> 00:02:45.020 + This file can help verify if the settings + you're making in a dashboard are actually + + 38 + 00:02:45.020 --> 00:02:46.340 + being applied locally. + + 39 + 00:02:46.860 --> 00:02:50.940 + We should always check this file to see if + there are any unexpected values. + + 40 + 00:02:51.420 --> 00:02:55.700 + For example, let's say the user you're + troubleshooting for is expected to have a + + 41 + 00:02:55.700 --> 00:03:01.180 + specific device profile like office users, + meaning their devices should be connected to + + 42 + 00:03:01.220 --> 00:03:05.180 + a corporate network. First, + confirm that warp -settings has the correct + + 43 + 00:03:05.180 --> 00:03:09.090 + profile ID. If the profile ID is not the + expected value, + + 44 + 00:03:09.330 --> 00:03:13.210 + this might be an indication that the user + isn't matching the rules you've defined in + + 45 + 00:03:13.210 --> 00:03:15.250 + your Cloudflare device profile settings. + + 46 + 00:03:15.290 --> 00:03:19.770 + Also, if any specific changes have been made + to the device profile settings, + + 47 + 00:03:19.770 --> 00:03:23.930 + you can use this file to ensure the user is + receiving those updates. + + 48 + 00:03:23.970 --> 00:03:28.770 + For example, if you've updated a device + profile to use the MASQUE tunneling type + + 49 + 00:03:28.770 --> 00:03:32.730 + instead of WireGuard, + you can verify that the user has received + + 50 + 00:03:32.730 --> 00:03:36.130 + that update and will indeed attempt to + connect via MASQUE. + + 51 + 00:03:40.850 --> 00:03:45.410 + Daemon.log is a fairly detailed file that + contains everything going on in WARP, + + 52 + 00:03:45.650 --> 00:03:47.010 + such as the debug logs. + + 53 + 00:03:47.370 --> 00:03:50.890 + But before we open the file, + what is the WARP daemon? + + 54 + 00:03:51.010 --> 00:03:54.490 + It's the background process of WARP, + also known as service, + + 55 + 00:03:54.490 --> 00:03:56.254 + depending on your operating system. + + 56 + 00:03:56.254 --> 00:03:59.546 + When WARP is installed, + it's installed as both daemon, + + 57 + 00:03:59.546 --> 00:04:03.690 + the background process, + and as a GUI, which is the interface you see + + 58 + 00:04:03.730 --> 00:04:09.680 + here. The GUI, warp-diag and warp-cli can all + communicate with the Daemon. + + 59 + 00:04:10.360 --> 00:04:13.680 + There are multiple Daemon.log files and their + name chronologically. + + 60 + 00:04:14.240 --> 00:04:18.640 + Daemon.log is the most recent, + and daemon.3 .log is the oldest. + + 61 + 00:04:19.160 --> 00:04:20.520 + Let's go over the file now. + + 62 + 00:04:20.560 --> 00:04:24.600 + Line by line, we'll look at how daemon.log + should look like when WARP connects as + + 63 + 00:04:24.600 --> 00:04:28.600 + expected. When WARP starts, + it prints out its version information, + + 64 + 00:04:28.600 --> 00:04:33.760 + so we'll start there. Search for the string + "warp _ service : + + 65 + 00:04:33.760 --> 00:04:37.200 + Version :" and look for the most recent + entry. + + 66 + 00:04:37.560 --> 00:04:39.200 + That should be your current session. + + 67 + 00:04:39.360 --> 00:04:43.680 + Our team is optimizing warp-diag constantly, + so the string we mentioned in this video + + 68 + 00:04:43.720 --> 00:04:45.600 + might change slightly in the future. + + 69 + 00:04:45.760 --> 00:04:50.360 + The registration contains all the necessary + information to connect the WARP client, + + 70 + 00:04:50.360 --> 00:04:52.520 + which is stored securely on the machine. + + 71 + 00:04:53.520 --> 00:04:58.480 + If the GUI detects a missing registration, + it may attempt to obtain one if configured to + + 72 + 00:04:58.520 --> 00:05:02.680 + do so. Otherwise, it'll display missing + registration. + + 73 + 00:05:03.960 --> 00:05:07.400 + Once the registration is loaded, + WARP will attempt to connect, + + 74 + 00:05:07.400 --> 00:05:10.000 + but only if configured to do so + automatically. + + 75 + 00:05:10.560 --> 00:05:14.680 + Otherwise, it will only attempt to connect if + it was previously connected. + + 76 + 00:05:15.360 --> 00:05:20.440 + After registration, WARP will then retrieve + the device profile remotely via an API. + + 77 + 00:05:21.040 --> 00:05:24.960 + This includes the device configurations and + mode that will be used. + + 78 + 00:05:26.000 --> 00:05:30.120 + It's very important to be aware that the + device profile can be further influenced by a + + 79 + 00:05:30.120 --> 00:05:33.840 + local configuration file, + which is used by an MDM provider, + + 80 + 00:05:33.840 --> 00:05:35.560 + such as Intune or Kandji. + + 81 + 00:05:36.120 --> 00:05:39.480 + For more information on Cloudflare MDM + configuration, + + 82 + 00:05:39.480 --> 00:05:41.680 + you can refer to our documentation. + + 83 + 00:05:41.680 --> 00:05:45.280 + At this point, which components connect is + determined by the mode. + + 84 + 00:05:46.480 --> 00:05:51.640 + If the mode contains the Tunnel component, + for example Secure web gateway without DNS + + 85 + 00:05:51.680 --> 00:05:58.080 + filtering, we'll see "Initiate WARP." if the + mode contains the DNS component like Gateway + + 86 + 00:05:58.080 --> 00:06:00.800 + with DoH, we'll see "Initiate DNS". + + 87 + 00:06:01.640 --> 00:06:06.120 + If it contains both, like Gateway with WARP + will eventually see both. + + 88 + 00:06:06.880 --> 00:06:08.240 + Let's now review each. + + 89 + 00:06:10.000 --> 00:06:13.480 + Starting with initiate WARP for modes with + the Tunnel component. + + 90 + 00:06:14.110 --> 00:06:16.590 + The Tunnel component includes a firewall. + + 91 + 00:06:16.990 --> 00:06:21.550 + It starts off by allowing the tunnel endpoint + through the firewall and attempting to + + 92 + 00:06:21.550 --> 00:06:28.150 + connect it. When connecting the tunnel, + WARP attempts to connect to both IPv4 and + + 93 + 00:06:28.190 --> 00:06:30.070 + IPv6 at the same time. + + 94 + 00:06:30.350 --> 00:06:34.150 + This makes sure the end user will be + connected as fast as possible, + + 95 + 00:06:34.350 --> 00:06:36.790 + and this process is called Happy Eyeballs. + + 96 + 00:06:37.430 --> 00:06:42.230 + Once connected, a network interface is + created and it begins the task of updating + + 97 + 00:06:42.230 --> 00:06:46.710 + the routing table and the firewall according + to the exclude or include split tunnel + + 98 + 00:06:46.710 --> 00:06:50.470 + entries. These entries can be either domains + or IPs. + + 99 + 00:06:50.910 --> 00:06:54.310 + WARP will update the routing table + immediately for any IPs, + + 100 + 00:06:54.310 --> 00:06:59.030 + but for domains, it will rely on a DNS + resolution for these domains and will update + + 101 + 00:06:59.030 --> 00:07:00.990 + the routing table upon completion. + + 102 + 00:07:01.110 --> 00:07:05.030 + Once that's completed, + WARP performs two connectivity tests, + + 103 + 00:07:05.270 --> 00:07:07.550 + one in the tunnel and one out of the tunnel. + + 104 + 00:07:08.470 --> 00:07:12.710 + Moving on to initiate DNS and this is for + modes with DNS component. + + 105 + 00:07:13.270 --> 00:07:17.740 + For DNS, WARP will set itself as the default + DNS global provider, + + 106 + 00:07:17.740 --> 00:07:23.620 + and forward all DNS requests to Cloudflare + via DNS over HTTPS or DoH. + + 107 + 00:07:24.340 --> 00:07:27.300 + And in order to do that, + the following sequence needs to complete + + 108 + 00:07:27.300 --> 00:07:31.820 + successfully. First, attempt to connect to + the DoH endpoint. + + 109 + 00:07:32.900 --> 00:07:36.900 + Second, receive a DNS response from that DoH + endpoint. + + 110 + 00:07:38.060 --> 00:07:43.740 + Third, bind to localhost on 127.0.2.2 and + 127.0.2.3. + + 111 + 00:07:44.860 --> 00:07:49.460 + Fourth, update the system to use these IP's + as the DNS provider. + + 112 + 00:07:50.220 --> 00:07:54.540 + If all four steps happen without error, + WARP then performs a series of DNS + + 113 + 00:07:54.540 --> 00:07:59.340 + connectivity checks. These are end to end + tests which confirm that WARP is successfully + + 114 + 00:07:59.340 --> 00:08:03.780 + receiving DNS requests, + forwarding them to Cloudflare for resolution, + + 115 + 00:08:03.940 --> 00:08:05.900 + and receiving a valid response. + + 116 + 00:08:06.380 --> 00:08:09.140 + Here are some additional tips to make + troubleshooting easier. + + 117 + 00:08:11.060 --> 00:08:15.340 + You should use the search function in your + text editor to quickly locate terms like + + 118 + 00:08:15.340 --> 00:08:17.740 + error, DNS, or disconnected. + + 119 + 00:08:18.530 --> 00:08:21.570 + Also look for patterns such as repeated + entries. + + 120 + 00:08:21.810 --> 00:08:23.850 + These can point to specific issues. + + 121 + 00:08:24.450 --> 00:08:27.850 + And finally cross-referencing files from warp + -settings, + + 122 + 00:08:28.010 --> 00:08:31.930 + warp-s tatus and daemon.log can reveal + insights and a bigger picture. + + 123 + 00:08:32.690 --> 00:08:36.170 + For example, if warp -status shows + disconnected, + + 124 + 00:08:36.410 --> 00:08:41.090 + check daemon.log for error details and warp + -settings for potential misconfigurations. + + 125 + 00:08:45.930 --> 00:08:49.890 + There are other files that provide more + specific information depending on your issue. + + 126 + 00:08:50.290 --> 00:08:55.050 + Our team is optimizing warp-diag constantly, + so you might find more files in the future. + + 127 + 00:08:55.410 --> 00:08:58.250 + For an updated view on what you can find in + which file, + + 128 + 00:08:58.370 --> 00:09:02.610 + check out our troubleshooting guide. You now + understand the basics of warp-diag . + + 129 + 00:09:02.770 --> 00:09:05.850 + If you're still experiencing issues after + following these steps, + + 130 + 00:09:05.850 --> 00:09:08.250 + don't hesitate to reach out to our support + team. + + 131 + 00:09:08.290 --> 00:09:09.610 + We're always here to help. + + 132 + 00:09:09.930 --> 00:09:11.930 + Thanks for watching and see you soon. \ No newline at end of file From e68df4dfcf7e7184178a1fce572985f72750d40e Mon Sep 17 00:00:00 2001 From: Ann Ming Samborski Date: Thu, 14 Aug 2025 15:36:14 -0700 Subject: [PATCH 010/202] Update file transfer capabilities (#24431) Removing SFTP and SCP limitations for short-lived SSH --- .../use-cases/ssh/ssh-infrastructure-access.mdx | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx index 2f75f34b4abb24c..16673cd7bddaef9 100644 --- a/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx +++ b/src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx @@ -90,7 +90,7 @@ Users can use any SSH client to connect to the target, as long as they are logge ssh @ ``` -Access for Infrastructure also supports `scp` and `rsync` commands. Refer to [Known limitations](#known-limitations) for a list of unsupported SSH commands and features. +Access for Infrastructure also supports `scp`, `sftp`, and `rsync` commands. Refer to [Known limitations](#known-limitations) for a list of unsupported SSH commands and features. To learn more about user connections, refer to the [Access for Infrastructure documentation](/cloudflare-one/applications/non-http/infrastructure-apps/#4-connect-as-a-user). @@ -165,8 +165,6 @@ To set up the Logpush job, refer to [Logpush integration](/cloudflare-one/insigh The following SSH features are not supported: -- `sftp` commands -- `scp` commands that utilize OpenSSH versions > 9.0, because OpenSSH 9.0+ leverages `sftp` to execute the command - Local and remote port forwarding - SSH agent forwarding - X11 forwarding From 468680e5be4dcc1e1879fd7c14c4003cac1a5567 Mon Sep 17 00:00:00 2001 From: Jun Lee Date: Fri, 15 Aug 2025 09:01:10 +0100 Subject: [PATCH 011/202] [DO] Improving definition for namespace in Glossary (#24415) * Improving definition for namespace * Missing space * Updating bullet point to be more accurate * Updating namespace binding name clarification * Nit * Implementing feedback * Update src/content/glossary/durable-objects.yaml Co-authored-by: Joe Lee --------- Co-authored-by: Joe Lee --- src/content/glossary/durable-objects.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/content/glossary/durable-objects.yaml b/src/content/glossary/durable-objects.yaml index acedc31fa23fc53..e43f0bc58c3263c 100644 --- a/src/content/glossary/durable-objects.yaml +++ b/src/content/glossary/durable-objects.yaml @@ -7,7 +7,10 @@ entries: - term: "namespace" general_definition: |- - A container for a collection of Durable Objects that all share the same Durable Object (class) definition. A single namespace can have (tens of) millions of Durable Objects. Metrics are scoped per namespace. + A logical collection of Durable Objects that all share the same Durable Object (class) definition. A single namespace can have (tens of) millions of Durable Objects. Metrics are scoped per namespace. + + - The binding name of the namespace (as it will be exposed inside Worker code) is defined in the Wrangler file under the `durable_objects.bindings.name` key. Note that the binding name may not uniquely identify a namespace within an account. Instead, each namespace has a unique namespace ID, which you can view from the Cloudflare dashboard. + - You can instantiate a unique Durable Object within a namespace using [Durable Object namespace methods](/durable-objects/api/namespace/#methods). - term: "Durable Object" general_definition: |- From 2e1503e3bbfb6e4c341608c752f6b7217d11b0f6 Mon Sep 17 00:00:00 2001 From: alexmoraru7 <40365465+alexmoraru7@users.noreply.github.com> Date: Fri, 15 Aug 2025 12:58:22 +0100 Subject: [PATCH 012/202] Create 2025-08-15-brand-protection-bulk-endpoint.mdx (#24439) * Create 2025-08-15-brand-protection-bulk-endpoint.mdx * Fix date, update copy * Fix API URL to be relative --------- Co-authored-by: Nikita Cano <48366124+nikitacano@users.noreply.github.com> --- .../2025-08-15-brand-protection-bulk-endpoint.mdx | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 src/content/changelog/security-center/2025-08-15-brand-protection-bulk-endpoint.mdx diff --git a/src/content/changelog/security-center/2025-08-15-brand-protection-bulk-endpoint.mdx b/src/content/changelog/security-center/2025-08-15-brand-protection-bulk-endpoint.mdx new file mode 100644 index 000000000000000..fa70bedd4c01069 --- /dev/null +++ b/src/content/changelog/security-center/2025-08-15-brand-protection-bulk-endpoint.mdx @@ -0,0 +1,9 @@ +--- +title: Save time with bulk query creation in Brand Protection +description: Quickly create and save multiple Brand Protection queries via API. +date: 2025-08-15 +--- + +[Brand Protection](/security-center/brand-protection/) detects domains that may be impersonating your brand — from common misspellings (`cloudfalre.com`) to malicious concatenations (`cloudflare-okta.com`). Saved search queries run continuously and alert you when suspicious domains appear. + +You can now create and save multiple queries in a single step, streamlining setup and management. Available now via the [Brand Protection bulk query creation API](/api/resources/brand_protection/subresources/queries/methods/bulk/). From 35c29aefaafe46da8e590001813fc5b99bcbfd2f Mon Sep 17 00:00:00 2001 From: Alex Robinson Date: Fri, 15 Aug 2025 07:23:26 -0500 Subject: [PATCH 013/202] Remove calls to sql.end() in Hyperdrive examples (#24429) As discussed, the workers runtime already handles closing outgoing connections as soon as a worker invocation finishes. And we have reason to believe that sql.end() can cause hangs due to a bug in postgres.js, so it's better to just not include it. I guess I didn't have to remove it from our node-postgres examples, but it isn't needed there either, so why clutter our examples with extra code? --- .../drizzle-orm.mdx | 5 +- src/content/docs/hyperdrive/get-started.mdx | 11 +- src/content/docs/hyperdrive/index.mdx | 4 - .../docs/workers/tutorials/postgres/index.mdx | 110 ++++++++---------- .../use-postgres-js-to-make-query.mdx | 4 - src/content/partials/prompts/base-prompt.txt | 4 - 6 files changed, 55 insertions(+), 83 deletions(-) diff --git a/src/content/docs/hyperdrive/examples/connect-to-postgres/postgres-drivers-and-libraries/drizzle-orm.mdx b/src/content/docs/hyperdrive/examples/connect-to-postgres/postgres-drivers-and-libraries/drizzle-orm.mdx index 53605c7085db2ce..5e24eb8f8130a35 100644 --- a/src/content/docs/hyperdrive/examples/connect-to-postgres/postgres-drivers-and-libraries/drizzle-orm.mdx +++ b/src/content/docs/hyperdrive/examples/connect-to-postgres/postgres-drivers-and-libraries/drizzle-orm.mdx @@ -87,9 +87,6 @@ export default { // Sample query to get all users const allUsers = await db.select().from(users); - // Clean up the connection - ctx.waitUntil(sql.end()); - return Response.json(allUsers); }, } satisfies ExportedHandler; @@ -169,4 +166,4 @@ Deploy your Worker. npx wrangler deploy ``` - \ No newline at end of file + diff --git a/src/content/docs/hyperdrive/get-started.mdx b/src/content/docs/hyperdrive/get-started.mdx index 3418dfabd0f93f6..b1590edae7bc505 100644 --- a/src/content/docs/hyperdrive/get-started.mdx +++ b/src/content/docs/hyperdrive/get-started.mdx @@ -233,10 +233,10 @@ export interface Env { export default { async fetch(request, env, ctx): Promise { // Create a client using the pg driver (or any supported driver, ORM or query builder) - // with the Hyperdrive credentials. These credentials are only accessible from your Worker. - const sql = new Client({ - connectionString: env.HYPERDRIVE.connectionString, - }); + // with the Hyperdrive credentials. These credentials are only accessible from your Worker. + const sql = new Client({ + connectionString: env.HYPERDRIVE.connectionString, + }); try { // Connect to the database @@ -245,9 +245,6 @@ export default { // Sample query const results = await sql.query(`SELECT * FROM pg_tables`); - // Clean up the client after the response is returned, before the Worker is killed - ctx.waitUntil(sql.end()); - // Return result rows as JSON return Response.json(results.rows); } catch (e) { diff --git a/src/content/docs/hyperdrive/index.mdx b/src/content/docs/hyperdrive/index.mdx index 11305d518e5940a..37c0f2447736a79 100644 --- a/src/content/docs/hyperdrive/index.mdx +++ b/src/content/docs/hyperdrive/index.mdx @@ -53,10 +53,6 @@ export default { try { // Sample SQL query const results = await sql`SELECT * FROM pg_tables`; - - // Close the client after the response is returned - ctx.waitUntil(sql.end()); - return Response.json(results); } catch (e) { return Response.json({ error: e instanceof Error ? e.message : e }, { status: 500 }); diff --git a/src/content/docs/workers/tutorials/postgres/index.mdx b/src/content/docs/workers/tutorials/postgres/index.mdx index ae91da2c55970e5..71802b9c20cc6b2 100644 --- a/src/content/docs/workers/tutorials/postgres/index.mdx +++ b/src/content/docs/workers/tutorials/postgres/index.mdx @@ -206,23 +206,18 @@ export default { const sql = new Client({ connectionString: env.DB_URL, }); - try { - // Connect to the PostgreSQL database - await sql.connect(); - - // Query the products table - const result = await sql.query("SELECT * FROM products"); - - // Return the result as JSON - return new Response(JSON.stringify(result.rows), { - headers: { - "Content-Type": "application/json", - }, - }); - } finally { - // Clean up the client connection - await sql.end(); - } + // Connect to the PostgreSQL database + await sql.connect(); + + // Query the products table + const result = await sql.query("SELECT * FROM products"); + + // Return the result as JSON + return new Response(JSON.stringify(result.rows), { + headers: { + "Content-Type": "application/json", + }, + }); }, } satisfies ExportedHandler; ``` @@ -260,49 +255,44 @@ export default { const sql = new Client({ connectionString: env.DB_URL, }); - try { - // Connect to the PostgreSQL database - await sql.connect(); - - const url = new URL(request.url); - if (request.method === "POST" && url.pathname === "/products") { - // Parse the request's JSON payload - const productData = (await request.json()) as { - name: string; - description: string; - price: number; - }; - - const name = productData.name, - description = productData.description, - price = productData.price; - - // Insert the new product into the products table - const insertResult = await sql.query( - `INSERT INTO products(name, description, price) VALUES($1, $2, $3) - RETURNING *`, - [name, description, price], - ); - - // Return the inserted row as JSON - return new Response(JSON.stringify(insertResult.rows), { - headers: { "Content-Type": "application/json" }, - }); - } - - // Query the products table - const result = await sql.query("SELECT * FROM products"); - - // Return the result as JSON - return new Response(JSON.stringify(result.rows), { - headers: { - "Content-Type": "application/json", - }, - }); - } finally { - // Clean up the client connection - await sql.end(); - } + // Connect to the PostgreSQL database + await sql.connect(); + + const url = new URL(request.url); + if (request.method === "POST" && url.pathname === "/products") { + // Parse the request's JSON payload + const productData = (await request.json()) as { + name: string; + description: string; + price: number; + }; + + const name = productData.name, + description = productData.description, + price = productData.price; + + // Insert the new product into the products table + const insertResult = await sql.query( + `INSERT INTO products(name, description, price) VALUES($1, $2, $3) + RETURNING *`, + [name, description, price], + ); + + // Return the inserted row as JSON + return new Response(JSON.stringify(insertResult.rows), { + headers: { "Content-Type": "application/json" }, + }); + } + + // Query the products table + const result = await sql.query("SELECT * FROM products"); + + // Return the result as JSON + return new Response(JSON.stringify(result.rows), { + headers: { + "Content-Type": "application/json", + }, + }); }, } satisfies ExportedHandler; ``` diff --git a/src/content/partials/hyperdrive/use-postgres-js-to-make-query.mdx b/src/content/partials/hyperdrive/use-postgres-js-to-make-query.mdx index 1bf2d91b4b919ee..8850f455b021dda 100644 --- a/src/content/partials/hyperdrive/use-postgres-js-to-make-query.mdx +++ b/src/content/partials/hyperdrive/use-postgres-js-to-make-query.mdx @@ -41,10 +41,6 @@ export default { // A very simple test query const result = await sql`select * from pg_tables`; - // Clean up the client, ensuring we don't kill the worker before that is - // completed. - ctx.waitUntil(sql.end()); - // Return result rows as JSON return Response.json({ success: true, result: result }); } catch (e: any) { diff --git a/src/content/partials/prompts/base-prompt.txt b/src/content/partials/prompts/base-prompt.txt index 56aba8c5bc64527..b2bd43d65914873 100644 --- a/src/content/partials/prompts/base-prompt.txt +++ b/src/content/partials/prompts/base-prompt.txt @@ -541,10 +541,6 @@ const sql = postgres(env.HYPERDRIVE.connectionString) // Test query const results = await sql`SELECT * FROM pg_tables`; - // Clean up the client, ensuring we don't kill the worker before that is - // completed. - ctx.waitUntil(sql.end()); - // Return result rows as JSON return Response.json(results); } catch (e) { From 0431331bfda21a3fe68ece732bf5408bb5790684 Mon Sep 17 00:00:00 2001 From: Boyan Bratvanov <6027160+bratvanov@users.noreply.github.com> Date: Fri, 15 Aug 2025 16:08:50 +0300 Subject: [PATCH 014/202] [Workers] fix typo in nextjs.mdx (#24425) * Fix typo in nextjs.mdx * Fix another typo --- src/content/docs/workers/framework-guides/web-apps/nextjs.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/workers/framework-guides/web-apps/nextjs.mdx b/src/content/docs/workers/framework-guides/web-apps/nextjs.mdx index 908a6a9b26e2c35..c039a5c876ee2d4 100644 --- a/src/content/docs/workers/framework-guides/web-apps/nextjs.mdx +++ b/src/content/docs/workers/framework-guides/web-apps/nextjs.mdx @@ -24,7 +24,7 @@ import { args="my-next-app --framework=next" /> -This is a simple getting started guide. For detailed documentation on how the to use the Cloudflare OpenNext adapter, visit the [OpenNext website](https://opennext.js.org/cloudflare). +This is a simple getting started guide. For detailed documentation on how to use the Cloudflare OpenNext adapter, visit the [OpenNext website](https://opennext.js.org/cloudflare). ## What is Next.js? @@ -180,7 +180,7 @@ You can convert an existing Next.js application to run on Cloudflare 7. **Test your site with the Cloudflare adapter.** The command used in the previous step uses the Next.js development server to offer a great developer experience. - However your application will run on Cloudflare Workers so you want to run your integration tests and verify that your application workers correctly in this environment. + However your application will run on Cloudflare Workers so you want to run your integration tests and verify that your application works correctly in this environment. From 8ccbf6aa2259fed9b3820f914a1869873d069d23 Mon Sep 17 00:00:00 2001 From: Kody Jackson Date: Fri, 15 Aug 2025 08:12:56 -0500 Subject: [PATCH 015/202] [Chore] Rename products to directory (#24417) * [Chore] Rename products to directory * updated component name --- astro.config.ts | 2 +- public/__redirects | 3 ++- .../{ProductCatalog.tsx => DirectoryCatalog.tsx} | 8 ++++---- src/components/HeaderDropdowns.tsx | 2 +- src/components/HomepageHero.astro | 2 +- .../homepage/FeaturedContentSection.astro | 2 +- src/components/overrides/Footer.astro | 2 +- src/components/overrides/PageTitle.astro | 4 ++-- .../developer-spotlight/application-guide.mdx | 2 +- src/content/docs/dns/get-started.mdx | 6 +++--- .../fundamentals/api/how-to/make-api-calls.mdx | 2 +- .../docs/fundamentals/manage-domains/index.mdx | 9 ++++----- .../workers/devplat/intro-to-devplat.mdx | 15 +++++++++------ .../architectures/security.mdx | 2 +- src/content/docs/waf/tools/lists/index.mdx | 2 +- .../email-security/reference-detect-phish.mdx | 13 ++++++------- src/pages/{products.astro => directory.astro} | 9 ++++----- src/pages/index.astro | 12 ++++++------ src/pages/plans.astro | 6 +++--- worker/index.worker.test.ts | 4 ++-- 20 files changed, 54 insertions(+), 53 deletions(-) rename src/components/{ProductCatalog.tsx => DirectoryCatalog.tsx} (95%) rename src/pages/{products.astro => directory.astro} (81%) diff --git a/astro.config.ts b/astro.config.ts index 36f6af23a20ce23..3a28b6cba44f327 100644 --- a/astro.config.ts +++ b/astro.config.ts @@ -142,7 +142,7 @@ export default defineConfig({ "{props.*}", "/", "/glossary/", - "/products/", + "/directory/", "/rules/snippets/examples/?operation=*", "/rules/transform/examples/?operation=*", "/ruleset-engine/rules-language/fields/reference/**", diff --git a/public/__redirects b/public/__redirects index 16034c21cfbaef8..603671b7cd81c72 100644 --- a/public/__redirects +++ b/public/__redirects @@ -1,6 +1,7 @@ # homepage /api /api/ 301 -/docs/ /products/ 301 +/docs/ /directory/ 301 +/products/ /directory/ 301 /zero-trust/ /products/?product-group=Cloudflare+One 301 /dashboard-landing/ / 301 /tutorials/ /search/?content_type%5B0%5D=Tutorial 301 diff --git a/src/components/ProductCatalog.tsx b/src/components/DirectoryCatalog.tsx similarity index 95% rename from src/components/ProductCatalog.tsx rename to src/components/DirectoryCatalog.tsx index 7d405883ec48e2d..9eb7466952c4930 100644 --- a/src/components/ProductCatalog.tsx +++ b/src/components/DirectoryCatalog.tsx @@ -13,7 +13,7 @@ type Filters = { groups: string[]; }; -const ProductCatalog = ({ products }: { products: ProductData[] }) => { +const DirectoryCatalog = ({ products }: { products: ProductData[] }) => { const [filters, setFilters] = useState({ search: "", groups: [], @@ -74,7 +74,7 @@ const ProductCatalog = ({ products }: { products: ProductData[] }) => { setFilters({ ...filters, search: e.target.value })} /> @@ -116,7 +116,7 @@ const ProductCatalog = ({ products }: { products: ProductData[] }) => {
{productList.length === 0 && (
- No products found + No folders found

Try a different search term, or broaden your search by removing filters. @@ -163,4 +163,4 @@ const ProductCatalog = ({ products }: { products: ProductData[] }) => { ); }; -export default ProductCatalog; +export default DirectoryCatalog; diff --git a/src/components/HeaderDropdowns.tsx b/src/components/HeaderDropdowns.tsx index d18353dea2a1d57..b62f64ecf87cbd9 100644 --- a/src/components/HeaderDropdowns.tsx +++ b/src/components/HeaderDropdowns.tsx @@ -11,7 +11,7 @@ import { useState } from "react"; import { PiCaretDownBold } from "react-icons/pi"; const links = [ - { label: "Docs Directory", href: "/products/" }, + { label: "Docs Directory", href: "/directory/" }, { label: "APIs", href: "https://developers.cloudflare.com/api/", diff --git a/src/components/HomepageHero.astro b/src/components/HomepageHero.astro index 3684bcbd4a52c86..58eb97d67b2083e 100644 --- a/src/components/HomepageHero.astro +++ b/src/components/HomepageHero.astro @@ -45,7 +45,7 @@ if (image) {

- Products + Directory Subscriptions and billing API Changelog diff --git a/src/components/homepage/FeaturedContentSection.astro b/src/components/homepage/FeaturedContentSection.astro index b017f51839c2ccc..ba3851b109b4b45 100644 --- a/src/components/homepage/FeaturedContentSection.astro +++ b/src/components/homepage/FeaturedContentSection.astro @@ -63,7 +63,7 @@ const { title, text, image, cards, imagePosition } = props.parse(Astro.props);
diff --git a/src/components/overrides/Footer.astro b/src/components/overrides/Footer.astro index ef0400e4270d833..a608644f80e5811 100644 --- a/src/components/overrides/Footer.astro +++ b/src/components/overrides/Footer.astro @@ -13,7 +13,7 @@ const groups = Object.entries({ text: "New to Cloudflare?", href: "/fundamentals/", }, - { text: "Products", href: "/products/" }, + { text: "Directory", href: "/directory/" }, { text: "Sponsorships", href: "/sponsorships/", diff --git a/src/components/overrides/PageTitle.astro b/src/components/overrides/PageTitle.astro index 18ef3bd5c143b3b..b6272ca7d61d0e5 100644 --- a/src/components/overrides/PageTitle.astro +++ b/src/components/overrides/PageTitle.astro @@ -25,8 +25,8 @@ const slug = Astro.locals.starlightRoute.entry.slug; const breadcrumbProps: Record = { crumbs: [ { - text: "Products", - href: "/products/", + text: "Directory", + href: "/directory/", }, ], truncated: true, diff --git a/src/content/docs/developer-spotlight/application-guide.mdx b/src/content/docs/developer-spotlight/application-guide.mdx index 93e615b3a251595..b6e1315290744e5 100644 --- a/src/content/docs/developer-spotlight/application-guide.mdx +++ b/src/content/docs/developer-spotlight/application-guide.mdx @@ -23,7 +23,7 @@ Your tutorial must be: 2. Technically accurate. 3. Entirely original, written only by you. 4. Written following Cloudflare's documentation style guide. For more information, please visit our [style guide documentation](/style-guide/) and our [tutorial style guide documentation](/style-guide/documentation-content-strategy/content-types/tutorial/#template) -5. About how to use [Cloudflare's Developer Platform products](/products/?product-group=Developer+platform) to create a project or solve a problem. +5. About how to use [Cloudflare's Developer Platform products](/directory/?product-group=Developer+platform) to create a project or solve a problem. 6. Complete, not an unfinished draft. ## How to apply diff --git a/src/content/docs/dns/get-started.mdx b/src/content/docs/dns/get-started.mdx index dff2edd49f61001..c3c89826434d02b 100644 --- a/src/content/docs/dns/get-started.mdx +++ b/src/content/docs/dns/get-started.mdx @@ -16,7 +16,7 @@ You can use Cloudflare DNS with a variety of [setups](/dns/zone-setups/). For an In the most common setup (full), you [add your domain](/fundamentals/manage-domains/add-site/), import your [DNS records](/dns/manage-dns-records/), and [update your nameservers](/dns/nameservers/update-nameservers/) to make Cloudflare your primary authoritative DNS provider. :::note -Make sure to [review your DNS records](/dns/zone-setups/full-setup/setup/#review-dns-records) before updating your nameservers. If you activate your domain on Cloudflare *without* setting up the correct DNS records, your domain may not be reachable. +Make sure to [review your DNS records](/dns/zone-setups/full-setup/setup/#review-dns-records) before updating your nameservers. If you activate your domain on Cloudflare _without_ setting up the correct DNS records, your domain may not be reachable. ::: Once the setup is completed: @@ -33,7 +33,7 @@ The following links introduce important concepts and will guide you through acti - [Nameservers](/dns/nameservers/): In the context of Cloudflare DNS, nameservers refer to authoritative nameservers. When a nameserver is authoritative for `example.com`, it means that DNS resolvers will consider responses from this nameserver when a user tries to access `example.com`. -- [Proxy status](/dns/proxy-status/): Proxy status affects how Cloudflare treats incoming HTTP/S requests to A, AAAA, and CNAME records. When a record is proxied, Cloudflare responds with [anycast IPs](/fundamentals/concepts/cloudflare-ip-addresses/), which speeds up and protects HTTP/S traffic with our [cache](/cache/)/[CDN](https://www.cloudflare.com/learning/cdn/what-is-a-cdn/), [DDoS protection](/ddos-protection/), [WAF](/waf/), and [more](/products/?product-group=Application+performance%2CApplication+security). +- [Proxy status](/dns/proxy-status/): Proxy status affects how Cloudflare treats incoming HTTP/S requests to A, AAAA, and CNAME records. When a record is proxied, Cloudflare responds with [anycast IPs](/fundamentals/concepts/cloudflare-ip-addresses/), which speeds up and protects HTTP/S traffic with our [cache](/cache/)/[CDN](https://www.cloudflare.com/learning/cdn/what-is-a-cdn/), [DDoS protection](/ddos-protection/), [WAF](/waf/), and [more](/directory/?product-group=Application+performance%2CApplication+security). ## Further reading @@ -41,4 +41,4 @@ The following links introduce important concepts and will guide you through acti - [DNS analytics](/dns/additional-options/analytics/): An overview of the different data sources and insights you can get when using Cloudflare DNS. -- [Troubleshooting](/dns/troubleshooting/): A full resources list for when something is not working. \ No newline at end of file +- [Troubleshooting](/dns/troubleshooting/): A full resources list for when something is not working. diff --git a/src/content/docs/fundamentals/api/how-to/make-api-calls.mdx b/src/content/docs/fundamentals/api/how-to/make-api-calls.mdx index 616b4302dc5534d..7eedbf8d35253c1 100644 --- a/src/content/docs/fundamentals/api/how-to/make-api-calls.mdx +++ b/src/content/docs/fundamentals/api/how-to/make-api-calls.mdx @@ -36,7 +36,7 @@ Every Cloudflare API element is fixed to a version number. The latest version is For specific guidance on making API calls, refer to the following resources: -- The product's [Developer Docs section](/products/) for how-to guides. +- The product's [Developer Docs section](/directory/) for how-to guides. - [API schema docs](/api/) for request and response payloads for each endpoint. - The first-party libraries for [Go](https://github.com/cloudflare/cloudflare-go), [TypeScript](https://github.com/cloudflare/cloudflare-typescript), [Python](https://github.com/cloudflare/cloudflare-python), or [HashiCorp's Terraform](https://github.com/cloudflare/terraform-provider-cloudflare). diff --git a/src/content/docs/fundamentals/manage-domains/index.mdx b/src/content/docs/fundamentals/manage-domains/index.mdx index 84fc2ec72a3b7da..0a2e36d90c2ee44 100644 --- a/src/content/docs/fundamentals/manage-domains/index.mdx +++ b/src/content/docs/fundamentals/manage-domains/index.mdx @@ -3,18 +3,17 @@ pcx_content_type: navigation title: Domains sidebar: order: 6 - --- -A *domain* or *domain name* (also known as a *zone*) is the location of a website or application, or what an end user types into their browser to get to your website (`example.com`). +A _domain_ or _domain name_ (also known as a _zone_) is the location of a website or application, or what an end user types into their browser to get to your website (`example.com`). -## Get a domain name +## Get a domain name You can purchase domain names for your website from a variety of places, such as through popular website builders or dedicated [registrars](https://www.cloudflare.com/learning/dns/glossary/what-is-a-domain-name-registrar/). Cloudflare offers an at-cost registrar service to [purchase new domain names](/registrar/get-started/register-domain/) or [transfer existing domain names](/registrar/get-started/transfer-domain-to-cloudflare/). -Refer to [Account and domain management best practices](/fundamentals/reference/best-practices/) for a detailed list of ways to protect your account and domain. +Refer to [Account and domain management best practices](/fundamentals/reference/best-practices/) for a detailed list of ways to protect your account and domain. ## Host your domain @@ -26,7 +25,7 @@ Cloudflare does not offer web hosting for most websites, though you can deploy a For help onboarding a domain to Cloudflare's CDN, refer to our [setup guide](/fundamentals/manage-domains/add-site/). -You will need to [update your domain's nameservers](/dns/zone-setups/full-setup/) and [proxy](/dns/proxy-status/) your web traffic to benefit from caching, DDoS protection, Argo Smart Routing, and other [application security and performance products](/products/?product-group=Application+performance%2CApplication+security). +You will need to [update your domain's nameservers](/dns/zone-setups/full-setup/) and [proxy](/dns/proxy-status/) your web traffic to benefit from caching, DDoS protection, Argo Smart Routing, and other [application security and performance products](/directory/?product-group=Application+performance%2CApplication+security). ## Get free SSL certificates diff --git a/src/content/docs/learning-paths/workers/devplat/intro-to-devplat.mdx b/src/content/docs/learning-paths/workers/devplat/intro-to-devplat.mdx index fdf3977eb83b9e6..3e04f48bb23a727 100644 --- a/src/content/docs/learning-paths/workers/devplat/intro-to-devplat.mdx +++ b/src/content/docs/learning-paths/workers/devplat/intro-to-devplat.mdx @@ -3,20 +3,23 @@ title: Cloudflare Developer Platform pcx_content_type: learning-unit sidebar: order: 1 - --- -import { Render, Stream } from "~/components" +import { Render, Stream } from "~/components"; The [Cloudflare Developer Platform](https://www.cloudflare.com/developer-platform/products/) offers various services to empower developers to build full-stack applications, including: [compute](https://www.cloudflare.com/developer-platform/products/#compute), [storage](https://www.cloudflare.com/developer-platform/products/#storage), [web development, image optimization, video streaming](https://www.cloudflare.com/developer-platform/products/#webdev) and [AI](https://ai.cloudflare.com/). - + It is important to note that the developer platform product offering is growing with new releases and features updates. To review a list of product documentation related to Cloudflare Developer Platform: 1. Go to [Cloudflare Docs](https://developers.cloudflare.com). 2. Select **Product directory** in the top menu. -3. Select the **Developer platform** filter to view [product documentation for Cloudflare Developer Platform products](/products/?product-group=Developer+platform). +3. Select the **Developer platform** filter to view [product documentation for Cloudflare Developer Platform products](/directory/?product-group=Developer+platform). ## Web development @@ -54,8 +57,8 @@ For a detailed guide to choosing the correct storage option, refer to [Choose a You have learned: -* More about what the Cloudflare Developer Platform offers. -* The difference between compute, storage, application development, and AI products. +- More about what the Cloudflare Developer Platform offers. +- The difference between compute, storage, application development, and AI products. ## Feedback diff --git a/src/content/docs/reference-architecture/architectures/security.mdx b/src/content/docs/reference-architecture/architectures/security.mdx index 9ddcd5ab8eb1652..2cf4a6b237604d0 100644 --- a/src/content/docs/reference-architecture/architectures/security.mdx +++ b/src/content/docs/reference-architecture/architectures/security.mdx @@ -113,7 +113,7 @@ In summary, Cloudflare not only has built the right technology to secure our net ## Using Cloudflare to protect your business -The reason the Cloudflare network exists is to provide services to customers to protect their own assets, such as users, applications, and data. The following section details what these services are, their basic architecture, and how they are used by customers. Note that this section does not go into extensive detail on each service. Instead, please refer to our [Architecture Center](https://cloudflare.com/architecture) or [product documentation](/products/) to understand more about a specific product, service, or solution. The goal in this document is to provide information about the overall set of security services available and the general use cases they are designed for. As such, we provide a table of contents so you can jump to a section of interest. +The reason the Cloudflare network exists is to provide services to customers to protect their own assets, such as users, applications, and data. The following section details what these services are, their basic architecture, and how they are used by customers. Note that this section does not go into extensive detail on each service. Instead, please refer to our [Architecture Center](https://cloudflare.com/architecture) or [product documentation](/directory/) to understand more about a specific product, service, or solution. The goal in this document is to provide information about the overall set of security services available and the general use cases they are designed for. As such, we provide a table of contents so you can jump to a section of interest. 1. [Securing public and private resources](#securing-public-and-private-resources) 2. [Protecting public resources](#protecting-public-resources) diff --git a/src/content/docs/waf/tools/lists/index.mdx b/src/content/docs/waf/tools/lists/index.mdx index 369b80e039e3ba6..25ab0fd4a566f29 100644 --- a/src/content/docs/waf/tools/lists/index.mdx +++ b/src/content/docs/waf/tools/lists/index.mdx @@ -49,7 +49,7 @@ Both the Cloudflare dashboard and the Cloudflare API support lists: - To reference a list in an API expression, refer to [Values: Lists](/ruleset-engine/rules-language/values/#lists) in the Rules language reference. :::caution -Currently, not all Cloudflare products support lists in their expressions. Refer to the documentation of each [individual product](/products/) for details on list support. +Currently, not all Cloudflare products support lists in their expressions. Refer to the documentation of each [individual product](/directory/) for details on list support. ::: ### Search list items diff --git a/src/content/partials/email-security/reference-detect-phish.mdx b/src/content/partials/email-security/reference-detect-phish.mdx index 8d357479f9723cd..00a3e17deb3522c 100644 --- a/src/content/partials/email-security/reference-detect-phish.mdx +++ b/src/content/partials/email-security/reference-detect-phish.mdx @@ -1,9 +1,8 @@ --- {} - --- -import { GlossaryTooltip } from "~/components" +import { GlossaryTooltip } from "~/components"; Email Security (formerly Area 1) uses a variety of factors to determine whether a given email message, a web domain or URL, or specific network traffic is part of a phishing campaign (marked with a `Malicious` disposition) or other common campaigns (for example, `Spam`). @@ -11,14 +10,14 @@ These small pattern assessments are dynamic in nature and — in many cases — ## ActiveSensors -ActiveSensors is a proprietary sensor network that discovers emergent campaign infrastructure, and aggregates attack data from relay points that actors use to launch their threat campaign. Cloudflare's [Network](/products/?product-group=Network+security) and [Application Security](/products/?product-group=Application+security) provide early detection on phishing attacks, malware, URLs, domains, IPs, and ASNs from across the Internet. +ActiveSensors is a proprietary sensor network that discovers emergent campaign infrastructure, and aggregates attack data from relay points that actors use to launch their threat campaign. Cloudflare's [Network](/directory/?product-group=Network+security) and [Application Security](/directory/?product-group=Application+security) provide early detection on phishing attacks, malware, URLs, domains, IPs, and ASNs from across the Internet. ActiveSensors does the following: -* Infrastructure monitoring, clustering and correlation. -* User and target impersonation-based crawls. -* Machine learning based link analysis and content detection. -* Payload analysis, in-the-wild sandboxing, content denotation, and reconstruction. +- Infrastructure monitoring, clustering and correlation. +- User and target impersonation-based crawls. +- Machine learning based link analysis and content detection. +- Payload analysis, in-the-wild sandboxing, content denotation, and reconstruction. ## SPARSE (Small Pattern Analytics Engine) diff --git a/src/pages/products.astro b/src/pages/directory.astro similarity index 81% rename from src/pages/products.astro rename to src/pages/directory.astro index 4348bc1b36f4cc3..b37082de6b3a7d2 100644 --- a/src/pages/products.astro +++ b/src/pages/directory.astro @@ -4,8 +4,8 @@ import { getCollection, type CollectionEntry } from "astro:content"; import iconCollection from "virtual:astro-icon"; import StarlightPage from "@astrojs/starlight/components/StarlightPage.astro"; import { getIconData, iconToSVG } from "@iconify/utils"; -import ProductCatalog from "~/components/ProductCatalog"; -import type { ProductData } from "~/components/ProductCatalog"; +import DirectoryCatalog from "~/components/DirectoryCatalog"; +import type { ProductData } from "~/components/DirectoryCatalog"; import type { StarlightPageProps } from "@astrojs/starlight/props"; let products: CollectionEntry<"products">[] = await getCollection( @@ -37,8 +37,7 @@ let productData: ProductData[] = products const props = { frontmatter: { title: "Docs directory", - description: - "Explore the different areas of our documentation site.", + description: "Explore the different areas of our documentation site.", template: "splash", }, hideBreadcrumbs: true, @@ -46,5 +45,5 @@ const props = { --- - + diff --git a/src/pages/index.astro b/src/pages/index.astro index 13c33040960eb05..bfa3bc51c0a5364 100644 --- a/src/pages/index.astro +++ b/src/pages/index.astro @@ -51,8 +51,8 @@ const topCards = [ }, ], cta: { - text: "View all products", - href: "/products/", + text: "View all docs", + href: "/directory/", }, }, { @@ -66,7 +66,7 @@ const topCards = [ ], cta: { text: "View all developer products", - href: "/products/?product-group=Developer+platform", + href: "/directory/?product-group=Developer+platform", }, }, { @@ -84,7 +84,7 @@ const topCards = [ ], cta: { text: "View all AI products", - href: "/products/?product-group=AI", + href: "/directory/?product-group=AI", }, }, { @@ -104,7 +104,7 @@ const topCards = [ ], cta: { text: "View all Cloudflare One products", - href: "/products/?product-group=Cloudflare+One", + href: "/directory/?product-group=Cloudflare+One", }, }, ]; @@ -217,7 +217,7 @@ const recommendedSection = { {link.text} diff --git a/src/pages/plans.astro b/src/pages/plans.astro index cbf079539eb238e..38f964ff6dac9d9 100644 --- a/src/pages/plans.astro +++ b/src/pages/plans.astro @@ -120,8 +120,8 @@ import { ProductFeatures } from "~/components"; Developer products: Refer to the Developer Platform pricing page or individual product docs to learn more about plans - and pricing. + > or individual product docs to learn more about + plans and pricing.
  • Zero Trust products: Refer to the
  • Other products: Refer to the individual product docsproduct docs to learn more about plans and pricing.
    • diff --git a/worker/index.worker.test.ts b/worker/index.worker.test.ts index 89c02de4803e72a..b50e9b55849b05a 100644 --- a/worker/index.worker.test.ts +++ b/worker/index.worker.test.ts @@ -33,14 +33,14 @@ describe("Cloudflare Docs", () => { const request = new Request("http://fakehost/docs/"); const response = await SELF.fetch(request, { redirect: "manual" }); expect(response.status).toBe(301); - expect(response.headers.get("Location")).toBe("/products/"); + expect(response.headers.get("Location")).toBe("/directory/"); }); it("redirects requests without a trailing slash", async () => { const request = new Request("http://fakehost/docs"); const response = await SELF.fetch(request, { redirect: "manual" }); expect(response.status).toBe(301); - expect(response.headers.get("Location")).toBe("/products/"); + expect(response.headers.get("Location")).toBe("/directory/"); }); it("redirects /workers/index.html.md to /workers/index.md", async () => { From 6facb9199dfece864e067481202049b2df4ae30b Mon Sep 17 00:00:00 2001 From: Kody Jackson Date: Fri, 15 Aug 2025 08:16:30 -0500 Subject: [PATCH 016/202] [Video] Render video description at top of the page' (#24443) --- src/pages/videos/[...slug].astro | 1 + 1 file changed, 1 insertion(+) diff --git a/src/pages/videos/[...slug].astro b/src/pages/videos/[...slug].astro index 8046ec22414d0fc..f23c3647e8e20d1 100644 --- a/src/pages/videos/[...slug].astro +++ b/src/pages/videos/[...slug].astro @@ -54,6 +54,7 @@ if (entry.transcript) { --- +

    {entry.description}

    { From a22dd84cda9992a3edae1229c2c684e1e1ab6fc1 Mon Sep 17 00:00:00 2001 From: Kody Jackson Date: Fri, 15 Aug 2025 09:02:15 -0500 Subject: [PATCH 017/202] [Stream] Video chapters collapsed (#24445) * [Stream] Chapters in collapsible details * [Stream] Add optional expandChapters prop --- src/components/Stream.astro | 80 ++++++++++--------- src/content/docs/cache/index.mdx | 2 +- .../learning-paths/r2-intro/series/r2-4.mdx | 2 +- .../docs/style-guide/components/details.mdx | 23 ++++-- .../docs/style-guide/components/stream.mdx | 8 ++ 5 files changed, 67 insertions(+), 48 deletions(-) diff --git a/src/components/Stream.astro b/src/components/Stream.astro index dfac7032804a9fb..20f08e4dfe027df 100644 --- a/src/components/Stream.astro +++ b/src/components/Stream.astro @@ -2,6 +2,7 @@ import { z } from "astro:schema"; import { Badge } from "@astrojs/starlight/components"; import parse from "parse-duration"; +import Details from "./Details.astro"; type Props = z.input; @@ -12,12 +13,12 @@ const props = z thumbnail: z.string().optional(), chapters: z.record(z.string(), z.string()).optional(), showMoreVideos: z.boolean().default(false), + expandChapters: z.boolean().default(false), }) .strict(); -const { id, title, thumbnail, chapters, showMoreVideos } = props.parse( - Astro.props, -); +const { id, title, thumbnail, chapters, showMoreVideos, expandChapters } = + props.parse(Astro.props); const BASE_URL = `https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/`; @@ -53,42 +54,43 @@ if (thumbnail) { { chapters && ( -

    - Chapters -

      - {Object.entries(chapters).map(([chapter, time]) => { - const totalSeconds = parse(time, "s"); - - const thumbnail = new URL(thumbnailUrl); - thumbnail.searchParams.set("fit", "crop"); - thumbnail.searchParams.set("time", `${totalSeconds}s`); - - return ( -
    • - -
      • - ); - })} -
    -

    +
    +

    +

      + {Object.entries(chapters).map(([chapter, time]) => { + const totalSeconds = parse(time, "s"); + + const thumbnail = new URL(thumbnailUrl); + thumbnail.searchParams.set("fit", "crop"); + thumbnail.searchParams.set("time", `${totalSeconds}s`); + + return ( +
    • + +
      • + ); + })} +
    +

    +
    ) } diff --git a/src/content/docs/cache/index.mdx b/src/content/docs/cache/index.mdx index 3060b7c1e6115fe..cdc5b7182dea792 100644 --- a/src/content/docs/cache/index.mdx +++ b/src/content/docs/cache/index.mdx @@ -20,7 +20,7 @@ Cache content across Cloudflare's global server network. Cache stores copies of frequently accessed content (such as images, videos, or webpages) in geographically distributed data centers that are located closer to end users than origin servers, reducing server load and improving website performance. - + ## Features diff --git a/src/content/docs/learning-paths/r2-intro/series/r2-4.mdx b/src/content/docs/learning-paths/r2-intro/series/r2-4.mdx index 113dac21aa44139..2a720cb1a3d7e25 100644 --- a/src/content/docs/learning-paths/r2-intro/series/r2-4.mdx +++ b/src/content/docs/learning-paths/r2-intro/series/r2-4.mdx @@ -15,7 +15,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2. The video will demonstrate the step-by-step process of setting up and executing a data migration. - + ` to add a collapsible container. ```mdx live -import { Details } from "~/components" +import { Details } from "~/components"; -
    - Hello, world! -
    +
    Hello, world!
    ``` You can specify the default configuration of each instance of the `
    ` component (that is, whether it is open or closed by default). ```mdx live -import { Details } from "~/components" +import { Details } from "~/components"; -
    - Long piece of code example. +
    + Long piece of code example.
    ``` + +## Properties + +- `header` +- `id` + + Adds a specific `id` to the HTML element + +- `open` diff --git a/src/content/docs/style-guide/components/stream.mdx b/src/content/docs/style-guide/components/stream.mdx index f2a7564feee7978..b5231af049cfc79 100644 --- a/src/content/docs/style-guide/components/stream.mdx +++ b/src/content/docs/style-guide/components/stream.mdx @@ -72,6 +72,14 @@ Either a timestamp (i.e `2.5s` or `1m35s`) or a URL to an image. Optional chapters displayed as cards below the video. +### `expandChapters` + +**type:** `boolean` + +**default:** `false` + +If `chapters` is present, is passed through to the `open` property of the [Details component](/style-guide/components/details/). + ### `showMoreVideos` **type:** `boolean` From 075a1397b7067fcfa4b5d24e3b6ca27d791ba3d5 Mon Sep 17 00:00:00 2001 From: kennyj42 <73258453+kennyj42@users.noreply.github.com> Date: Fri, 15 Aug 2025 10:10:45 -0500 Subject: [PATCH 018/202] Update to reflect Metadata boundary updates (#24406) * Update logpush-datasets.mdx * Update compatibility.mdx --- src/content/docs/data-localization/compatibility.mdx | 4 ++-- .../data-localization/metadata-boundary/logpush-datasets.mdx | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/content/docs/data-localization/compatibility.mdx b/src/content/docs/data-localization/compatibility.mdx index 78070b4fe6c1a50..4089505cb748cb5 100644 --- a/src/content/docs/data-localization/compatibility.mdx +++ b/src/content/docs/data-localization/compatibility.mdx @@ -104,7 +104,7 @@ The table below provides a summary of the Data Localization Suite product's beha | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ----------------- | --------------- | ----------------- | -------------------------- | -| Access | 🚧 [^14] | 🚧 [^15] | 🚧 [^16] | +| Access | 🚧 [^14] | 🚧 [^15] | ✅ [^16] | | Browser Isolation | ⚫️ | 🚧 [^17] | ✅ | | CASB | ⚫️ | ⚫️ | ✘ | | Cloudflare Tunnel | ⚫️ | 🚧 [^18] | ⚫️ | @@ -142,7 +142,7 @@ The table below provides a summary of the Data Localization Suite product's beha [^15]: Can be localized to US FedRAMP Moderate Domestic region only. -[^16]: Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. +[^16]: Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. EU customers must use Logpush to retain logs. [^17]: Currently may only be used with US FedRAMP region. diff --git a/src/content/docs/data-localization/metadata-boundary/logpush-datasets.mdx b/src/content/docs/data-localization/metadata-boundary/logpush-datasets.mdx index 26196037cf9a331..7c39e4151343489 100644 --- a/src/content/docs/data-localization/metadata-boundary/logpush-datasets.mdx +++ b/src/content/docs/data-localization/metadata-boundary/logpush-datasets.mdx @@ -34,6 +34,6 @@ Be aware that if you enable CMB for a dataset that does not support your region, | Network Analytics Logs | Account | ✅ | ✅ | ✅ | | Device Posture Results | Account | ✘ | ✅ | ✘ | | Audit Logs | Account | ✘ | ✅ | ✘ | -| Access Requests | Account | ✅ | ✅ | ✘ | +| Access Requests | Account | ✅ | ✅ | ✅ | [^1]: Customer Metadata Boundary does not apply in this case, as these logs are sent directly from the processing location to your configured destination. From 00dcc9094450f853d5870c932c4f3144239b6f04 Mon Sep 17 00:00:00 2001 From: Patricia Santa Ana <103445940+patriciasantaana@users.noreply.github.com> Date: Fri, 15 Aug 2025 09:35:30 -0700 Subject: [PATCH 019/202] icons (#24418) --- src/content/docs/style-guide/components/cards.mdx | 11 +++++++++++ src/content/docs/style-guide/components/icons.mdx | 13 ++++++++++++- src/content/docs/style-guide/components/tabs.mdx | 11 ++++++++++- src/content/partials/style-guide/icons.mdx | 6 ++++++ 4 files changed, 39 insertions(+), 2 deletions(-) create mode 100644 src/content/partials/style-guide/icons.mdx diff --git a/src/content/docs/style-guide/components/cards.mdx b/src/content/docs/style-guide/components/cards.mdx index ed8460019366611..25a693b7377bbd2 100644 --- a/src/content/docs/style-guide/components/cards.mdx +++ b/src/content/docs/style-guide/components/cards.mdx @@ -4,6 +4,8 @@ styleGuide: component: Card --- +import { Render } from "~/components"; + Cards are a built-in component provided by [Starlight](https://starlight.astro.build/components/cards/). ## Cards @@ -43,3 +45,12 @@ import { LinkTitleCard } from "~/components"; Interesting content you want to highlight. ``` + +## Card icons + + diff --git a/src/content/docs/style-guide/components/icons.mdx b/src/content/docs/style-guide/components/icons.mdx index 9d1cfd979eee012..b180e02601c3f25 100644 --- a/src/content/docs/style-guide/components/icons.mdx +++ b/src/content/docs/style-guide/components/icons.mdx @@ -2,6 +2,8 @@ title: Icons --- +import { Render } from "~/components"; + There are two icon components which pull from two different icon sets. ## astro-icon @@ -24,4 +26,13 @@ The Starlight icon set is available to use in `Tab`, `Card` and other Starlight import { StarlightIcon } from "~/components"; -``` \ No newline at end of file +``` + +## Icon library + + \ No newline at end of file diff --git a/src/content/docs/style-guide/components/tabs.mdx b/src/content/docs/style-guide/components/tabs.mdx index 35efc85cbf564ce..6f9e8e4004f56ce 100644 --- a/src/content/docs/style-guide/components/tabs.mdx +++ b/src/content/docs/style-guide/components/tabs.mdx @@ -4,7 +4,7 @@ styleGuide: component: Tabs --- -import { Tabs, TabItem } from '~/components'; +import { Tabs, TabItem, Render } from '~/components'; This component can help you create a tabbed interface to show related information more efficiently. Use it when there are different ways of getting the same thing done: @@ -27,6 +27,15 @@ import { Tabs, TabItem } from '~/components'; ``` +### Tab icons + + + ## Synchronize Tabs If you have tabs that follow a particular pattern (Dashboard / API / Terraform), add a `syncKey` parameter that includes a `string` value. diff --git a/src/content/partials/style-guide/icons.mdx b/src/content/partials/style-guide/icons.mdx new file mode 100644 index 000000000000000..0ff4d9b2bdff1b2 --- /dev/null +++ b/src/content/partials/style-guide/icons.mdx @@ -0,0 +1,6 @@ +--- +params: + - component +--- + +Optionally, you can choose a corresponding icon from Starlight’s [Icons](https://starlight.astro.build/reference/icons/#all-icons) for {props.component}. \ No newline at end of file From 905db077ccbbeb3fc9ab46958b8221070ce797b0 Mon Sep 17 00:00:00 2001 From: Mark J Miller <34665164+markjmiller@users.noreply.github.com> Date: Fri, 15 Aug 2025 10:40:07 -0600 Subject: [PATCH 020/202] docs: add new workers improvements changelog (#24025) docs: add new workers improvements changelog Co-authored-by: Brendan Irvine-Broque Cina Saffary --- ...workers-terraform-and-sdk-improvements.mdx | 133 ++++++++++++++++++ 1 file changed, 133 insertions(+) create mode 100644 src/content/changelog/workers/2025-08-14-workers-terraform-and-sdk-improvements.mdx diff --git a/src/content/changelog/workers/2025-08-14-workers-terraform-and-sdk-improvements.mdx b/src/content/changelog/workers/2025-08-14-workers-terraform-and-sdk-improvements.mdx new file mode 100644 index 000000000000000..71100f87446e32c --- /dev/null +++ b/src/content/changelog/workers/2025-08-14-workers-terraform-and-sdk-improvements.mdx @@ -0,0 +1,133 @@ +--- +title: Terraform provider improvements — Python Workers support, smaller plan diffs, and API SDK fixes +description: Multiple improvements to the Workers Terraform resources and SDKs including fixes for plan diffs, file uploads, and Python Workers support. +products: + - workers +date: 2025-08-14 +--- + +The recent [Cloudflare Terraform Provider](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/workers_script) and SDK releases (such as [cloudflare-typescript](https://github.com/cloudflare/cloudflare-typescript)) bring significant improvements to the Workers developer experience. These updates focus on reliability, performance, and adding [Python Workers](/workers/languages/python/) support. + +## Terraform Improvements + +### Fixed Unwarranted Plan Diffs + +Resolved several issues with the `cloudflare_workers_script` resource that resulted in unwarranted plan diffs, including: + +- Using Durable Objects migrations +- Using some bindings such as `secret_text` +- Using smart placement + +A resource should never show a plan diff if there isn't an actual change. This fix reduces unnecessary noise in your Terraform plan and is available in Cloudflare Terraform Provider 5.8.0. + +### Improved File Management + +You can now specify `content_file` and `content_sha256` instead of `content`. This prevents the Workers script content from being stored in the state file which greatly reduces plan diff size and noise. If your workflow synced plans remotely, this should now happen much faster since there is less data to sync. This is available in Cloudflare Terraform Provider 5.7.0. + +```tf +resource "cloudflare_workers_script" "my_worker" { + account_id = "123456789" + script_name = "my_worker" + main_module = "worker.mjs" + content_file = "worker.mjs" + content_sha256 = filesha256("worker.mjs") +} +``` + +### Assets Headers and Redirects Support + +Fixed the `cloudflare_workers_script` resource to properly support headers and redirects for Assets: + +```tf +resource "cloudflare_workers_script" "my_worker" { + account_id = "123456789" + script_name = "my_worker" + main_module = "worker.mjs" + content_file = "worker.mjs" + content_sha256 = filesha256("worker.mjs") + assets = { + config = { + headers = file("_headers") + redirects = file("_redirects") + } + # Completion jwt from: + # https://developers.cloudflare.com/api/resources/workers/subresources/assets/subresources/upload/ + jwt = "jwt" + } +} +``` + +Available in Cloudflare Terraform Provider 5.8.0. + +### Python Workers Support + +Added support for uploading [Python Workers](/workers/languages/python/) (beta) in Terraform. You can now deploy Python Workers with: + +```tf +resource "cloudflare_workers_script" "my_worker" { + account_id = "123456789" + script_name = "my_worker" + content_file = "worker.py" + content_sha256 = filesha256("worker.py") + content_type = "text/x-python" +} +``` + +Available in Cloudflare Terraform Provider 5.8.0. + +## SDK Enhancements + +### Improved File Upload API + +Fixed an issue where Workers script versions in the SDK did not allow uploading files. This now works, and also has an improved files upload interface: + +```js +const scriptContent = ` + export default { + async fetch(request, env, ctx) { + return new Response('Hello World!', { status: 200 }); + } + }; +`; + +client.workers.scripts.versions.create('my-worker', { + account_id: '123456789', + metadata: { + main_module: 'my-worker.mjs', + }, + files: [ + await toFile( + Buffer.from(scriptContent), + 'my-worker.mjs', + { + type: "application/javascript+module", + } + ) + ] +}); +``` + +Will be available in cloudflare-typescript 4.6.0. A similar change will be available in cloudflare-python 4.4.0. + +### Fixed updating KV values + +Previously when creating a KV value like this: + +```js +await cf.kv.namespaces.values.update("my-kv-namespace", "key1", { + account_id: "123456789", + metadata: "my metadata", + value: JSON.stringify({ + hello: "world" + }) +}); +``` + +...and recalling it in your Worker like this: +```ts +const value = await c.env.KV.get<{hello: string}>("key1", "json"); +``` + +You'd get back this: `{metadata:'my metadata', value:"{'hello':'world'}"}` instead of the correct value of `{hello: 'world'}` + +This is fixed in cloudflare-typescript 4.5.0 and will be fixed in cloudflare-python 4.4.0. From 5edd3939fbb2294b217a50d7e894937f29be5624 Mon Sep 17 00:00:00 2001 From: Ann Ming Samborski Date: Fri, 15 Aug 2025 09:49:12 -0700 Subject: [PATCH 021/202] Create 2025-08-15-sftp-support (#24432) --- src/content/changelog/access/2025-08-15-sftp.mdx | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 src/content/changelog/access/2025-08-15-sftp.mdx diff --git a/src/content/changelog/access/2025-08-15-sftp.mdx b/src/content/changelog/access/2025-08-15-sftp.mdx new file mode 100644 index 000000000000000..035c27d1175f33a --- /dev/null +++ b/src/content/changelog/access/2025-08-15-sftp.mdx @@ -0,0 +1,9 @@ +--- +title: SFTP support for SSH with Cloudflare Access for Infrastructure +description: SSH with Cloudflare Access for Infrastructure now supports SFTP for easy file transfer. +date: 2025-08-15 +products: + - access +--- + +[SSH with Cloudflare Access for Infrastructure](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/) now supports SFTP. It is compatible with SFTP clients, such as Cyberduck. From f3337abed7d02d5b5b4655179b59cdef0a41fb3a Mon Sep 17 00:00:00 2001 From: kennyj42 <73258453+kennyj42@users.noreply.github.com> Date: Fri, 15 Aug 2025 11:49:25 -0500 Subject: [PATCH 022/202] Create 2025-07-01-Access-Supports-Customer-Metadata-Boundary.mdx (#24405) * Create 2025-07-01-Access-Supports-Customer-Metadata-Boundary.mdx * Apply suggestions from code review * Update src/content/changelog/access/2025-07-01-Access-Supports-Customer-Metadata-Boundary.mdx * Update src/content/changelog/access/2025-07-01-Access-Supports-Customer-Metadata-Boundary.mdx --------- Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- ...1-Access-Supports-Customer-Metadata-Boundary.mdx | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 src/content/changelog/access/2025-07-01-Access-Supports-Customer-Metadata-Boundary.mdx diff --git a/src/content/changelog/access/2025-07-01-Access-Supports-Customer-Metadata-Boundary.mdx b/src/content/changelog/access/2025-07-01-Access-Supports-Customer-Metadata-Boundary.mdx new file mode 100644 index 000000000000000..c7f5ea93bac1254 --- /dev/null +++ b/src/content/changelog/access/2025-07-01-Access-Supports-Customer-Metadata-Boundary.mdx @@ -0,0 +1,13 @@ +--- +title: Cloudflare Access Logging supports the Customer Metadata Boundary (CMB) +description: Access logs will now respect the CMB. +date: 2025-08-14 +products: + - access +--- + +Cloudflare Access logs now support the [Customer Metadata Boundary (CMB)](/data-localization/metadata-boundary/). If you have configured the CMB for your account, all Access logging will respect that configuration. + +:::note +For EU CMB customers, the logs will not be stored by Access and will appear as empty in the dashboard. EU CMB customers should utilize [Logpush](/logs/logpush/) to retain their Access logging, if desired. +::: From 50d93848f260b392cdcff1da0e644759b6e64dc1 Mon Sep 17 00:00:00 2001 From: Kody Jackson Date: Fri, 15 Aug 2025 11:50:43 -0500 Subject: [PATCH 023/202] Snippets examples fix (#24451) * Snippets examples fix * Fix * Update core rules --- src/content/docs/rules/examples.mdx | 11 ++++++++--- src/content/docs/rules/snippets/examples/index.mdx | 4 ++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/src/content/docs/rules/examples.mdx b/src/content/docs/rules/examples.mdx index 8dde5961b885dd6..a58fb9de79a47d0 100644 --- a/src/content/docs/rules/examples.mdx +++ b/src/content/docs/rules/examples.mdx @@ -10,9 +10,14 @@ import { ResourcesBySelector, GlossaryTooltip } from "~/components"; Explore the following examples for Rules. +:::note + +We have a separate listing for [Cache rules examples](/cache/how-to/cache-rules/examples/). + +::: + diff --git a/src/content/docs/rules/snippets/examples/index.mdx b/src/content/docs/rules/snippets/examples/index.mdx index 376bd26c1da85c4..07483c1b6185417 100644 --- a/src/content/docs/rules/snippets/examples/index.mdx +++ b/src/content/docs/rules/snippets/examples/index.mdx @@ -14,7 +14,7 @@ Refer to the following examples to get started creating your snippet code. Refer to [How it works](/rules/snippets/how-it-works/) and [Create a snippet in the dashboard](/rules/snippets/create-dashboard/) for overall guidance. From a6a372bea65656dea5d3177526942e98d072dfdb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Denise=20Pe=C3=B1a?= <75506267+dcpena@users.noreply.github.com> Date: Fri, 15 Aug 2025 11:51:05 -0500 Subject: [PATCH 024/202] [Video] Swapped out Stream links with YT links (#24449) * Swapped out Stream links with YT links * Link update --- .../tutorials/build-a-comments-api/index.mdx | 8 ++------ .../series/build-the-app-frontend-5.mdx | 9 ++------- .../series/deploy-your-video-call-app-7.mdx | 9 ++------- .../series/introduction-to-series-1.mdx | 14 ++------------ .../series/make-answer-webrtc-calls-6.mdx | 9 ++------- .../real-time-messaging-with-websockets-4.mdx | 9 ++------- .../series/serverless-websocket-backend-3.mdx | 9 ++------- .../series/what-are-durable-objects-2.mdx | 9 ++------- .../learning-paths/r2-intro/series/r2-1.mdx | 14 ++------------ .../learning-paths/r2-intro/series/r2-2.mdx | 14 ++------------ .../learning-paths/r2-intro/series/r2-3.mdx | 16 ++-------------- .../learning-paths/r2-intro/series/r2-4.mdx | 17 ++--------------- .../learning-paths/r2-intro/series/r2-5.mdx | 15 ++------------- .../workers/devplat/intro-to-devplat.mdx | 8 ++------ .../workflows-course/series/workflows-1.mdx | 18 ++---------------- .../workflows-course/series/workflows-2.mdx | 15 ++------------- .../workflows-course/series/workflows-3.mdx | 19 ++----------------- .../framework-guides/deploy-a-hono-site.mdx | 8 ++------ .../framework-guides/deploy-a-nuxt-site.mdx | 8 ++------ .../framework-guides/deploy-an-astro-site.mdx | 8 ++------ .../pages/framework-guides/nextjs/index.mdx | 8 ++------ .../index.mdx | 8 ++------ src/content/docs/use-cases/ai.mdx | 4 ++-- .../features/function-calling/index.mdx | 4 ++-- ...generation-using-deepseek-coder-models.mdx | 4 ++-- ...ers-ai-models-using-a-jupyter-notebook.mdx | 4 ++-- ...choose-the-right-text-generation-model.mdx | 4 ++-- .../image-generator-flux-newmodels.mdx | 9 ++------- .../image-generator-flux.mdx | 9 ++------- .../image-generator-store-and-catalog.mdx | 9 ++------- .../docs/workers/observability/logs/index.mdx | 4 ++-- .../docs/workers/runtime-apis/rpc/index.mdx | 8 ++------ .../docs/workflows/examples/twilio.mdx | 8 ++------ 33 files changed, 66 insertions(+), 253 deletions(-) diff --git a/src/content/docs/d1/tutorials/build-a-comments-api/index.mdx b/src/content/docs/d1/tutorials/build-a-comments-api/index.mdx index 3a37f87c24dd2ec..412814fea57829d 100644 --- a/src/content/docs/d1/tutorials/build-a-comments-api/index.mdx +++ b/src/content/docs/d1/tutorials/build-a-comments-api/index.mdx @@ -11,7 +11,7 @@ tags: - SQL --- -import { Render, PackageManagers, Stream, WranglerConfig } from "~/components"; +import { Render, PackageManagers, WranglerConfig, YouTube } from "~/components"; In this tutorial, you will learn how to use D1 to add comments to a static blog site. To do this, you will construct a new D1 database, and build a JSON API that allows the creation and retrieval of comments. @@ -39,11 +39,7 @@ cd d1-example ## Video Tutorial - + ## 1. Install Hono diff --git a/src/content/docs/learning-paths/durable-objects-course/series/build-the-app-frontend-5.mdx b/src/content/docs/learning-paths/durable-objects-course/series/build-the-app-frontend-5.mdx index 80c8d37055277cd..44e9488c541a5b0 100644 --- a/src/content/docs/learning-paths/durable-objects-course/series/build-the-app-frontend-5.mdx +++ b/src/content/docs/learning-paths/durable-objects-course/series/build-the-app-frontend-5.mdx @@ -6,7 +6,7 @@ sidebar: tableOfContents: false --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -14,12 +14,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; In this video, we set up the frontend starter code (the starter code is located in the Veet GitHub repository), connect to Durable Objects using a call room ID, and display a local video preview. - + diff --git a/src/content/docs/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7.mdx b/src/content/docs/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7.mdx index 89f5ae60ac0498c..91b5e7719266738 100644 --- a/src/content/docs/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7.mdx +++ b/src/content/docs/learning-paths/durable-objects-course/series/deploy-your-video-call-app-7.mdx @@ -6,7 +6,7 @@ sidebar: tableOfContents: false --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -14,12 +14,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; We are almost done with the project, and in this final episode, we add the finishing touches, such as learning how to handle call disconnections, wiring up essential media controls like muting/unmuting and video toggling, and integrating a TURN server to ensure reliable connections even behind firewalls. By the end of this video, your app will be fully functional and ready for deployment. - + diff --git a/src/content/docs/learning-paths/durable-objects-course/series/introduction-to-series-1.mdx b/src/content/docs/learning-paths/durable-objects-course/series/introduction-to-series-1.mdx index f9c7b7c9d847947..90ad9cd6fe63f63 100644 --- a/src/content/docs/learning-paths/durable-objects-course/series/introduction-to-series-1.mdx +++ b/src/content/docs/learning-paths/durable-objects-course/series/introduction-to-series-1.mdx @@ -6,24 +6,14 @@ sidebar: tableOfContents: false --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; In this episode, we present an overview of the series, discuss its underlying architecture, and access resources to set up the project locally. - - - - - - + diff --git a/src/content/docs/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6.mdx b/src/content/docs/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6.mdx index 53cbdf44d7046f7..151b5d0bbdeb7dc 100644 --- a/src/content/docs/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6.mdx +++ b/src/content/docs/learning-paths/durable-objects-course/series/make-answer-webrtc-calls-6.mdx @@ -6,7 +6,7 @@ sidebar: tableOfContents: false --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -14,12 +14,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; In this video, we build on the frontend we set up earlier by adding functionality for making and answering WebRTC video calls. You will learn how to create peer-to-peer connections, handle ICE candidates, and seamlessly send and receive video streams between users. - + diff --git a/src/content/docs/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4.mdx b/src/content/docs/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4.mdx index a26ccbb5bb1644b..49178b79fcb94cb 100644 --- a/src/content/docs/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4.mdx +++ b/src/content/docs/learning-paths/durable-objects-course/series/real-time-messaging-with-websockets-4.mdx @@ -6,7 +6,7 @@ sidebar: tableOfContents: false --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -14,12 +14,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; Now, we'll take it a step further by enabling our server to receive and broadcast messages. In this video, you'll learn how to route and broadcast incoming messages from WebSocket connections and implement error handling such as closed WebSocket connections. By the end, you will have completed the backend for our video call app. - + diff --git a/src/content/docs/learning-paths/durable-objects-course/series/serverless-websocket-backend-3.mdx b/src/content/docs/learning-paths/durable-objects-course/series/serverless-websocket-backend-3.mdx index 258713f281a4f78..a5c52a2e1562028 100644 --- a/src/content/docs/learning-paths/durable-objects-course/series/serverless-websocket-backend-3.mdx +++ b/src/content/docs/learning-paths/durable-objects-course/series/serverless-websocket-backend-3.mdx @@ -6,7 +6,7 @@ sidebar: tableOfContents: false --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -14,12 +14,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; In this video, we'll create a WebSocket backend using serverless technology, making the process simpler than ever before. You'll learn how to create your first Durable Object, set up a WebSocket server to coordinate connections, and keep track of connected clients. - + diff --git a/src/content/docs/learning-paths/durable-objects-course/series/what-are-durable-objects-2.mdx b/src/content/docs/learning-paths/durable-objects-course/series/what-are-durable-objects-2.mdx index 2d6e88748693dbe..6d01d8b4f98e169 100644 --- a/src/content/docs/learning-paths/durable-objects-course/series/what-are-durable-objects-2.mdx +++ b/src/content/docs/learning-paths/durable-objects-course/series/what-are-durable-objects-2.mdx @@ -6,7 +6,7 @@ sidebar: tableOfContents: false --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -14,12 +14,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; In this video, we show how Durable Objects work and start building a video call app together. - + diff --git a/src/content/docs/learning-paths/r2-intro/series/r2-1.mdx b/src/content/docs/learning-paths/r2-intro/series/r2-1.mdx index 107abf9993b9e9d..afc3ae7e99c1496 100644 --- a/src/content/docs/learning-paths/r2-intro/series/r2-1.mdx +++ b/src/content/docs/learning-paths/r2-intro/series/r2-1.mdx @@ -9,7 +9,7 @@ description: | --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -17,17 +17,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; Cloudflare R2 is an object storage solution designed to handle your data and files efficiently. It is ideal for various use cases, such as storing large media files, creating data lakes, or delivering web assets. R2 offers a flexible architecture to suit your needs, all with zero egress fees, meaning you don't have to worry about unexpected costs when moving your data. - + **Related content** diff --git a/src/content/docs/learning-paths/r2-intro/series/r2-2.mdx b/src/content/docs/learning-paths/r2-intro/series/r2-2.mdx index 385ed5efa364125..a4319862cc2597c 100644 --- a/src/content/docs/learning-paths/r2-intro/series/r2-2.mdx +++ b/src/content/docs/learning-paths/r2-intro/series/r2-2.mdx @@ -8,7 +8,7 @@ description: | This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain for greater control over content management and security, or using a Cloudflare-managed subdomain for a simpler configuration. --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -16,17 +16,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; This video outlines how to configure public buckets in R2, which are private by default, to enable public Internet access. It presents two methods for setting up public access: using a custom domain for greater control over content management and security, or a Cloudflare managed subdomain for a simpler configuration. - + **Related content** diff --git a/src/content/docs/learning-paths/r2-intro/series/r2-3.mdx b/src/content/docs/learning-paths/r2-intro/series/r2-3.mdx index a72f3a6f6e8bfbc..498f7267b85ee2f 100644 --- a/src/content/docs/learning-paths/r2-intro/series/r2-3.mdx +++ b/src/content/docs/learning-paths/r2-intro/series/r2-3.mdx @@ -8,7 +8,7 @@ description: | In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes. --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -16,19 +16,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; In this video, you'll learn how to use S3 API commands and tools with R2, set up and configure R2 for S3 API compatibility, and integrate R2 into your existing workflows with minimal changes. - + **Related content** diff --git a/src/content/docs/learning-paths/r2-intro/series/r2-4.mdx b/src/content/docs/learning-paths/r2-intro/series/r2-4.mdx index 2a720cb1a3d7e25..a68289e78b76246 100644 --- a/src/content/docs/learning-paths/r2-intro/series/r2-4.mdx +++ b/src/content/docs/learning-paths/r2-intro/series/r2-4.mdx @@ -9,7 +9,7 @@ description: | --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -17,20 +17,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; In this video, you will learn how to use Cloudflare R2's data migration tools to transfer data from other cloud providers such as Amazon S3 and Google Cloud Storage to R2. The video will demonstrate the step-by-step process of setting up and executing a data migration. - + **Related content** diff --git a/src/content/docs/learning-paths/r2-intro/series/r2-5.mdx b/src/content/docs/learning-paths/r2-intro/series/r2-5.mdx index 73f3027bc1b19db..7e66073978b4ffa 100644 --- a/src/content/docs/learning-paths/r2-intro/series/r2-5.mdx +++ b/src/content/docs/learning-paths/r2-intro/series/r2-5.mdx @@ -9,7 +9,7 @@ description: | --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -17,18 +17,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; In this video, you will set up a Cloudflare Workers project and connect it to an existing or new R2 bucket. You will secure file uploads using authentication tokens, configure the Wrangler settings, and enable Smart Tiered Cache for optimal performance. Finally, you will deploy and test your serverless API to upload and retrieve files such as podcast episodes. - + **Related content** diff --git a/src/content/docs/learning-paths/workers/devplat/intro-to-devplat.mdx b/src/content/docs/learning-paths/workers/devplat/intro-to-devplat.mdx index 3e04f48bb23a727..76d3a4a6bf90411 100644 --- a/src/content/docs/learning-paths/workers/devplat/intro-to-devplat.mdx +++ b/src/content/docs/learning-paths/workers/devplat/intro-to-devplat.mdx @@ -5,15 +5,11 @@ sidebar: order: 1 --- -import { Render, Stream } from "~/components"; +import { Render, YouTube } from "~/components" The [Cloudflare Developer Platform](https://www.cloudflare.com/developer-platform/products/) offers various services to empower developers to build full-stack applications, including: [compute](https://www.cloudflare.com/developer-platform/products/#compute), [storage](https://www.cloudflare.com/developer-platform/products/#storage), [web development, image optimization, video streaming](https://www.cloudflare.com/developer-platform/products/#webdev) and [AI](https://ai.cloudflare.com/). - + It is important to note that the developer platform product offering is growing with new releases and features updates. To review a list of product documentation related to Cloudflare Developer Platform: diff --git a/src/content/docs/learning-paths/workflows-course/series/workflows-1.mdx b/src/content/docs/learning-paths/workflows-course/series/workflows-1.mdx index fd8edd0168fe6ad..66d1288dcfec9ec 100644 --- a/src/content/docs/learning-paths/workflows-course/series/workflows-1.mdx +++ b/src/content/docs/learning-paths/workflows-course/series/workflows-1.mdx @@ -8,7 +8,7 @@ description: | Cloudflare Workflows provides durable execution capabilities, allowing developers to create reliable, repeatable workflows that run in the background. Workflows are designed to resume execution even if the underlying compute fails, ensuring that tasks complete eventually. They are built on top of Cloudflare Workers and handle scaling and provisioning automatically. --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -18,21 +18,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; Workflows are triggered by events, such as Event Notifications consumed from a Queue, HTTP requests, another Worker, or even scheduled timers. Individual steps within a Workflow are designed as retriable units of work. The state is persisted between steps, allowing workflows to resume from the last successful step after failures. Workflows automatically generate metrics for each step, aiding in debugging and observability. - + **Related content** diff --git a/src/content/docs/learning-paths/workflows-course/series/workflows-2.mdx b/src/content/docs/learning-paths/workflows-course/series/workflows-2.mdx index 53fc9e50c0aef6b..9ef39c68b48ee84 100644 --- a/src/content/docs/learning-paths/workflows-course/series/workflows-2.mdx +++ b/src/content/docs/learning-paths/workflows-course/series/workflows-2.mdx @@ -9,7 +9,7 @@ description: | --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -17,18 +17,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; Workflows can be used to process batches of data, ensuring each item in the batch goes through a defined process with reliable execution. This section demonstrates processing a batch of puns using the Punderful application as an example. - + **Related content** diff --git a/src/content/docs/learning-paths/workflows-course/series/workflows-3.mdx b/src/content/docs/learning-paths/workflows-course/series/workflows-3.mdx index 61502ad0ecd5734..48930255b7f9914 100644 --- a/src/content/docs/learning-paths/workflows-course/series/workflows-3.mdx +++ b/src/content/docs/learning-paths/workflows-course/series/workflows-3.mdx @@ -8,7 +8,7 @@ description: | Cloudflare Workflows provide a powerful way to manage asynchronous, durable processes. The ability to explicitly schedule tasks using cron triggers and pause execution with `step.sleep` allows developers to build sophisticated, time-aware applications. --- -import { Render, Tabs, TabItem, Stream, Card } from "~/components"; +import { Render, Tabs, TabItem, Card, YouTube } from "~/components"; @@ -16,22 +16,7 @@ import { Render, Tabs, TabItem, Stream, Card } from "~/components"; Cloudflare Workflows provide a powerful way to manage asynchronous, durable processes. The ability to explicitly schedule tasks using cron triggers and pause execution with `step.sleep` allows developers to build sophisticated, time-aware applications. - + **Related content** diff --git a/src/content/docs/pages/framework-guides/deploy-a-hono-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-hono-site.mdx index a056faf10e9311b..6662d4b73e79368 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-hono-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-hono-site.mdx @@ -17,7 +17,7 @@ import { TabItem, Tabs, PackageManagers, - Stream, + YouTube, } from "~/components"; [Hono](https://honojs.dev/) is a small, simple, and ultrafast web framework for Cloudflare Pages and Workers, Deno, and Bun. Learn more about the creation of Hono by [watching an interview](#creator-interview) with its creator, [Yusuke Wada](https://yusu.ke/). @@ -99,8 +99,4 @@ For demo applications using Hono and Cloudflare Pages, refer to the following re ### Creator Interview - + diff --git a/src/content/docs/pages/framework-guides/deploy-a-nuxt-site.mdx b/src/content/docs/pages/framework-guides/deploy-a-nuxt-site.mdx index 72049c3c7ce51d4..6649cd9ce93cc2a 100644 --- a/src/content/docs/pages/framework-guides/deploy-a-nuxt-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-a-nuxt-site.mdx @@ -18,7 +18,7 @@ import { ResourcesBySelector, ExternalResources, PackageManagers, - Stream, + YouTube, } from "~/components"; [Nuxt](https://nuxt.com) is a web framework making Vue.js-based development simple and powerful. @@ -27,11 +27,7 @@ In this guide, you will create a new Nuxt application and deploy it using Cloudf ### Video Tutorial - + ## Create a new project using the `create-cloudflare` CLI (C3) diff --git a/src/content/docs/pages/framework-guides/deploy-an-astro-site.mdx b/src/content/docs/pages/framework-guides/deploy-an-astro-site.mdx index 2cc5b84e534f282..d224d75e9a04778 100644 --- a/src/content/docs/pages/framework-guides/deploy-an-astro-site.mdx +++ b/src/content/docs/pages/framework-guides/deploy-an-astro-site.mdx @@ -12,7 +12,7 @@ import { PagesBuildPreset, Render, PackageManagers, - Stream, + YouTube, } from "~/components"; [Astro](https://astro.build) is an all-in-one web framework for building fast, content-focused websites. By default, Astro builds websites that have zero JavaScript runtime code. @@ -23,11 +23,7 @@ In this guide, you will create a new Astro application and deploy it using Cloud ### Video Tutorial - + ## Set up a new project diff --git a/src/content/docs/pages/framework-guides/nextjs/index.mdx b/src/content/docs/pages/framework-guides/nextjs/index.mdx index ea49010e87f2818..e7a64b4c2e794ef 100644 --- a/src/content/docs/pages/framework-guides/nextjs/index.mdx +++ b/src/content/docs/pages/framework-guides/nextjs/index.mdx @@ -11,16 +11,12 @@ banner: id: pages-migrate-to-workers --- -import { DirectoryListing, Stream } from "~/components"; +import { DirectoryListing, YouTube } from "~/components"; [Next.js](https://nextjs.org) is an open-source React framework for creating websites and applications. ### Video Tutorial - + diff --git a/src/content/docs/pages/tutorials/build-an-api-with-pages-functions/index.mdx b/src/content/docs/pages/tutorials/build-an-api-with-pages-functions/index.mdx index 6b7c965cbca82e8..1a6de967ed70281 100644 --- a/src/content/docs/pages/tutorials/build-an-api-with-pages-functions/index.mdx +++ b/src/content/docs/pages/tutorials/build-an-api-with-pages-functions/index.mdx @@ -7,7 +7,7 @@ tags: - JavaScript --- -import { Stream, PackageManagers } from "~/components"; +import { YouTube, PackageManagers } from "~/components"; In this tutorial, you will build a full-stack Pages application. Your application will contain: @@ -18,11 +18,7 @@ If you prefer to work with a headless CMS rather than an API to render your blog ## Video Tutorial - + ## 1. Build your front end diff --git a/src/content/docs/use-cases/ai.mdx b/src/content/docs/use-cases/ai.mdx index 39c8ccb1461bd1b..f366e7e83d3d2cc 100644 --- a/src/content/docs/use-cases/ai.mdx +++ b/src/content/docs/use-cases/ai.mdx @@ -7,11 +7,11 @@ head: --- -import { ExternalResources, ResourcesBySelector, Stream } from "~/components" +import { ExternalResources, ResourcesBySelector, YouTube } from "~/components" Build and deploy ambitious AI applications to Cloudflare's global network. - + ## Reference architectures diff --git a/src/content/docs/workers-ai/features/function-calling/index.mdx b/src/content/docs/workers-ai/features/function-calling/index.mdx index 3c78488a01d6d65..b636c381d604a3e 100644 --- a/src/content/docs/workers-ai/features/function-calling/index.mdx +++ b/src/content/docs/workers-ai/features/function-calling/index.mdx @@ -7,13 +7,13 @@ sidebar: text: Beta --- -import { Stream, TabItem, Tabs } from "~/components"; +import { YouTube, TabItem, Tabs } from "~/components"; Function calling enables people to take Large Language Models (LLMs) and use the model response to execute functions or interact with external APIs. The developer usually defines a set of functions and the required input schema for each function, which we call `tools`. The model then intelligently understands when it needs to do a tool call, and it returns a JSON output which the user needs to feed to another function or API. In essence, function calling allows you to perform actions with LLMs by executing code or making additional API calls. - + ## How can I use function calling? diff --git a/src/content/docs/workers-ai/guides/tutorials/explore-code-generation-using-deepseek-coder-models.mdx b/src/content/docs/workers-ai/guides/tutorials/explore-code-generation-using-deepseek-coder-models.mdx index 21fa1e10aed523f..de665e95e5fa72b 100644 --- a/src/content/docs/workers-ai/guides/tutorials/explore-code-generation-using-deepseek-coder-models.mdx +++ b/src/content/docs/workers-ai/guides/tutorials/explore-code-generation-using-deepseek-coder-models.mdx @@ -15,13 +15,13 @@ description: Explore how you can use AI models to generate code and work more ef -import { Stream } from "~/components" +import { YouTube } from "~/components" A handy way to explore all of the models available on [Workers AI](/workers-ai) is to use a [Jupyter Notebook](https://jupyter.org/). You can [download the DeepSeek Coder notebook](/workers-ai/static/documentation/notebooks/deepseek-coder-exploration.ipynb) or view the embedded notebook below. - + [comment]: <> "The markdown below is auto-generated from https://github.com/craigsdennis/notebooks-cloudflare-workers-ai" diff --git a/src/content/docs/workers-ai/guides/tutorials/explore-workers-ai-models-using-a-jupyter-notebook.mdx b/src/content/docs/workers-ai/guides/tutorials/explore-workers-ai-models-using-a-jupyter-notebook.mdx index 5862275d9161c9b..efc5697548756d6 100644 --- a/src/content/docs/workers-ai/guides/tutorials/explore-workers-ai-models-using-a-jupyter-notebook.mdx +++ b/src/content/docs/workers-ai/guides/tutorials/explore-workers-ai-models-using-a-jupyter-notebook.mdx @@ -12,7 +12,7 @@ description: This Jupyter notebook explores various models (including Whisper, D --- -import { Stream } from "~/components" +import { YouTube } from "~/components" A handy way to explore all of the models available on [Workers AI](/workers-ai) is to use a [Jupyter Notebook](https://jupyter.org/). @@ -20,7 +20,7 @@ You can [download the Workers AI notebook](/workers-ai-notebooks/cloudflare-work Or you can run this on [Google Colab](https://colab.research.google.com/github/craigsdennis/notebooks-cloudflare-workers-ai/blob/main/cloudflare-workers-ai.ipynb) - + [comment]: <> "The markdown below is auto-generated from https://github.com/craigsdennis/notebooks-cloudflare-workers-ai the