Existing documentation URL(s)
https://developers.cloudflare.com/waf/rate-limiting-rules/best-practices/#protecting-against-credential-stuffing
What changes are you suggesting?
https://developers.cloudflare.com/waf/rate-limiting-rules/best-practices/#protecting-against-credential-stuffing (and other sections in this page too) recommends rate limiting based on the path:
Hostname equals example.com and URI Path equals /login and Request Method equals POST
But this practice isn't always fully robust. Path manipulation or mangling can lead to policy bypass (1, 2). I believe it would be worth mentioning these potential shortcomings if using this solution, and maybe also link to how CF applies normalization.
Additional information
No response
Existing documentation URL(s)
https://developers.cloudflare.com/waf/rate-limiting-rules/best-practices/#protecting-against-credential-stuffing
What changes are you suggesting?
https://developers.cloudflare.com/waf/rate-limiting-rules/best-practices/#protecting-against-credential-stuffing (and other sections in this page too) recommends rate limiting based on the path:
But this practice isn't always fully robust. Path manipulation or mangling can lead to policy bypass (1, 2). I believe it would be worth mentioning these potential shortcomings if using this solution, and maybe also link to how CF applies normalization.
Additional information
No response
Footnotes
https://clement.notin.org/blog/2016/07/13/CVE-2016-5007-Spring-Security-MVC-Path-Matching-Inconsistency/ ↩
https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf ↩