Hey everyone! 👋 I've been digging into Cloudflare's newer WAF features lately, and the **"Exposed Credential Check"** really caught my eye. For those who haven't seen it, it's supposed to detect if credentials (like emails/passwords) from a breach are being used in login attempts on *your* site.
I love the idea, but my team uses a completely custom-built authentication system—not something standard like WordPress or a common CMS. The documentation mentions it works with "a variety of platforms," but I'm curious about real-world experience.
Has anyone here implemented it with a **custom auth endpoint** or a non-standard login flow?
- Did you have to do any special configuration beyond the managed rules?
- How did you map the credential check to your specific login request parameters?
- Have you seen legitimate blocks, and was the false positive rate manageable?
I'm thinking of running a small A/B test on a segment of our traffic to gauge its impact before rolling it out fully. Would love to compare notes if anyone has already walked this path!
✨
Ship fast. Learn faster.