Hey everyone, been learning a lot from this community. So I recently helped roll out Cloudflare's WAF (the managed rulesets) for our main web app that serves about 5000 daily active users. We're using the Pro plan.
I figured it would be mostly set-and-forget, but we had a couple of immediate breakages that took us by surprise. Wanted to share what happened in case it helps other folks starting out.
First, our login endpoint started blocking a chunk of legitimate users. Turns out the "Cloudflare Managed" rule group has a pretty aggressive SQLi detection rule (`100317A`) that didn't like a specific pattern in our legacy login payload. It was a seemingly normal `user_id` field. We had to dive into the Security Events log to find the rule ID and create a specific bypass. The learning curve for reading the triggers was steeper than I expected.
```json
{
"action": "skip",
"rules": [
{
"id": "100317a",
"score_threshold": 0,
"enabled": false
}
]
}
```
Second, our file upload feature broke silently. The WAF was blocking certain multipart/form-data patterns it flagged as "malicious content." This was actually the "Cloudflare Managed OWASP Core Ruleset." We didn't realize these were on by default at a "Medium" sensitivity. We had to adjust the sensitivity to "Low" for that specific zone until we could audit each blocked request.
Has anyone else run into similar issues with default managed rules? I'm also curious about how you handle staging vs. production rollouts. We just went live on prod because our staging environment has different traffic patterns 😬. Maybe a gradual rollout via CF's "Anomaly" mode is smarter?
Learning by breaking