Use these comparison operators, logical operators, functions, and fields in eCDN custom rule expressions and rate limiting rule expressions.
A rate limiting counting expression supports one additional field, HTTP Response Code (http.response.code). See Counting Expression.
Cache rule expressions use these operators and functions with a different set of fields. See Supported Expression Fields for Cache Rules.
Page Shield policies can use these fields as a reference when targeting specific pages. Page Shield expressions aren’t restricted to this list. See eCDN PCI 4.0 Compliance Tools.
The maximum length of a custom rule or rate limiting rule expression is 4096 characters.
To create a rule in Business Manager, see Create a Custom Firewall Rule for an eCDN Zone and Create a Rate Limiting Rule for an eCDN Zone in Salesforce Help.
eq, ne, contains, matches, in, lt, le, gt, ge
not, and, or, xor
| Function | Description | Usage in Expression | Type | Example |
|---|---|---|---|---|
| any | Returns true when the comparison operator in the argument returns true for any of the values in the argument array. Returns false otherwise. | any(Array<Boolean>) | Boolean | any(http.request.headers[\"content-type\"][*] eq \"application/x-www-form-urlencoded\") |
| all | Returns true when the comparison operator in the argument returns true for all values in the argument array. Returns false otherwise. | all(Array<Boolean>) | Boolean | all(http.request.headers[\"content-type\"][*] eq \"application/json\") |
| concat | Takes a comma-separated list of values. Concatenates the argument values into a single String. | concat( String | Integer | Bytes | Array elements) | String | concat(http.request.uri.path,\"String\") eq \"sampleString\" |
| ends_with | Returns true when the source ends with the given substring. Returns false otherwise. The source cannot be a literal value (for example, "foo"). | ends_with(sourceString, substringString) | Boolean | ends_with(http.request.uri.path, \".html\") |
| len | Returns the byte length of a String or Bytes field. | len(String | Bytes) | Integer | len(http.host) lt 20 |
| lookup_json_integer | Returns the integer value associated with the supplied key in field. Note: The field must be a string representation of a valid JSON document. The key can be an attribute name, a zero-based position number in a JSON array, or a combination of these two options (as extra function parameters), while following the hierarchy of the JSON document to obtain a specific integer value. This function only works for plain integers. For example, it will not work for floating numbers with a zero decimal part such as 42.0. | lookup_json_integer(fieldString, keyString | Integer [, keyString | Integer , …]) | Integer | lookup_json_integer(http.cookie, \"sampleCookie\") eq 10 lookup_json_integer(http.cookie, 1) eq 10 lookup_json_integer(http.cookie, 1, \"sampleCookie \") eq 10 |
| lookup_json_string | Returns the string value associated with the supplied key in field. Note: The field must be a string representation of a valid JSON document. The key can be an attribute name, a zero-based position number in a JSON array, or a combination of these two options (as extra function parameters), while following the hierarchy of the JSON document to obtain a specific value. | lookup_json_string(fieldString, keyString | Integer [, keyString | Integer, …]) | String | lookup_json_string(http.cookie, \"sampleCookie\") eq \"sampleString\" lookup_json_string(http.cookie, 1) eq \"sampleString\" lookup_json_string(http.cookie, 1, \"sampleCookie\") eq \"sampleString\" |
| lower | Converts a string field to lowercase. Only uppercase ASCII bytes are converted. All other bytes are unaffected. | lower(String) | String | lower(http.host) eq \"www.example.com\" |
| starts_with | Returns true when the source starts with a given substring. Returns false otherwise. The source cannot be a literal value (for example, "foo"). | starts_with(sourceString, substringString) | Boolean | starts_with(http.request.uri.path, \"/blog\") |
| substring | Returns part of the field value (the value of a String or Bytes field) from the start byte index up to (but excluding) the end byte index. The first byte in field has index 0. If you do not provide the optional end index, the function returns the part of the string from start index to the end of the string. The end index must be greater than the start index. The start and end indexes can be negative integer values, which allows you to access characters from the end of the string instead of the beginning. | substring(fieldString | Bytes, startInteger [, endInteger]) | String | substring(http.request.uri.path, 2, 5) eq \"sampleString\" substring(http.request.uri.path, 2) eq \"sampleString\" |
| upper | Converts a string field to uppercase. Only lowercase ASCII bytes are converted. All other bytes are unaffected. | upper(String) | String | upper(http.host) eq \"WWW.EXAMPLE.COM\" |
| url_decode | Decodes a URL-formatted string defined in source, as in the following: - %20 and + decode to a space character (“). The options parameter is optional. You must provide any options as a single string wrapped in quotes, such as "r" or "ur". The available options are the following: - r: Applies recursive decoding. For example, %2520 will be decoded twice (recursively) to a space character. - u: Enables Unicode percent decoding. For example, %E2%98%81%EF%B8%8F will be decoded to a cloud emoji. | url_decode(sourceString [, optionsString]) | String | url_decode(http.request.full_uri) contains \"sampleString\" url_decode(http.request.full_uri, \"ur\") contains \"sampleString\" |
Deprecated values ip.geoip.asnum, ip.geoip.country and ip.geoip.continent have been replaced with ip.src.asnum, ip.src.country, and ip.src.continent, respectively.
Note
The fields in the following table apply to custom rules and rate limiting rules. Page Shield expressions aren’t restricted to this list. Expressions are passed directly to Cloudflare without allowlist validation, so Cloudflare-supported fields that aren’t shown here can also be valid. For Page Shield, this table is a reference, not an exhaustive list.
Note
| Field | Description | Usage in Expression | Type | Example |
|---|---|---|---|---|
| AS Number | The Autonomous System (AS) number associated with the client IP address. | ip.src.asnum | Integer | ip.src.asnum eq 12345 |
| Cookie | Represents the entire cookie as a string. | http.cookie | String | http.cookie eq \"session=8521F670545D7865F79C3D7BEDC29CCE;-background=light\" |
| Cookie value of | The Cookie HTTP header on the request, represented as a Map (associative array) keyed by cookie name. Distinct from the existing “Cookie” field (http.cookie), which is the entire Cookie header as a single string. | http.request.cookies | Map | any(http.request.cookies[\"session\"][*] eq \"abc123\") |
| Country | Represents the 2-letter country code in ISO 3166-1 Alpha 2 format. | ip.src.country | String | not ip.src.country eq \"US\" |
| Host Name | Represents the host name used in the full request URI. | http.host | String | http.host eq \"www.example.com\" |
| IP Address | Represents the client TCP IP address. | ip.src | IP address | ip.src in {93.184.216.34 192.168.123.132} |
| HTTP Headers | Represents HTTP request headers as a Map (or associative array). | http.request.headers | Map\String\Array | any(http.request.headers[\"content-type\"][*] eq \"application/json\") |
| URI Full | Represents the full URI as received by the web server. | http.request.full_uri | String | http.request.full_uri eq \"https://www.example.com/path/index?section=123456&expand=comments\" |
| URI | Represents the URI path and query string of the request. | http.request.uri | String | http.request.uri eq \"/path/index?section=123456&expand=comments\" |
| URI Path | Represents the URI path of the request. | http.request.uri.path | String | http.request.uri.path eq \"/path/index\" |
| URI Query String | Represents the entire query string, without the ? delimiter. | http.request.uri.query | String | http.request.uri.query eq \"section=123456&expand=comments\" |
| Raw URI Full | Similar to the http.request.full_uri non-raw field. Represents the full URI as received by the web server without the URI fragment (if any) and without any transformation. Note that this raw field may include some basic normalization by the HTTP server. | raw.http.request.full_uri | String | raw.http.request.full_uri eq \"https://www.example.com/path/index?section=123456&expand=comments\" |
| Raw URI | Similar to the http.request.uri non-raw field. Represents the URI path and query string of the request without any transformation. Note that this raw field may include some basic normalization by the HTTP server. | raw.http.request.uri | String | raw.http.request.uri eq \"/path/index?section=123456&expand=comments\" |
| Raw URI Path | Similar to the http.request.uri.path non-raw field. Represents the URI path of the request without any transformation. Note that this raw field may include some basic normalization by the HTTP server. | raw.http.request.uri.path | String | raw.http.request.uri.path eq \"/path/index\" |
| Raw URI Query String | Similar to the http.request.uri.query non-raw field. Represents the entire query string without the ? delimiter and without any transformation. Note that this raw field may include some basic normalization by the HTTP server. | raw.http.request.uri.query | String | raw.http.request.uri.query eq \"section=123456&expand=comments\" |
| HTTP Referer | Represents the HTTP Referer request header, which contains the address of the web page that linked to the currently requested page. | http.referer | String | http.referer contains \"www.example.com\" |
| User Agent | Represents the HTTP user agent, a request header that contains a characteristic string to allow identification of the client operating system and web browser. | http.user_agent | String | http.user_agent eq \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Safari/537.36\" |
| Request Method | Represents the HTTP method, returned as a string of uppercase characters. | http.request.method | String | http.request.method eq \"GET\" |
| Continent | Represents the continent code associated with client IP address.AF – AfricaAN – AntarcticaAS – AsiaEU – EuropeNA – North AmericaOC – OceaniaSA – South AmericaT1 – Tor network | ip.src.continent | String | ip.src.continent in {\"NA\" \"EU\"} |
| WAF Attack Score | Represents the likelihood that a request is malicious, using a score from 1–99. A score of 1 indicates the request is almost certainly malicious; a score of 99 indicates the request is likely clean. The special score 100 indicates that Cloudflare did not score the request. | cf.waf.score | Integer | cf.waf.score lt 20 |
| Known Bot | Indicates whether the request originated from a known good bot or crawler. Available without a Bot Management add-on (base WAF). | cf.client.bot | Boolean | cf.client.bot |
| Verified Bot Category | Identifies the specific purpose or type of a verified bot, such as Search Engine Crawler or AI Crawler. Available without a Bot Management add-on (base WAF). See Cloudflare’s verified bot categories for the list of supported values. | cf.verified_bot_category | String (enum) | cf.verified_bot_category eq \"Search Engine Crawler\" |
| Bot Score* | Represents the likelihood that a request originates from a bot using a score from 1–99. A low score indicates that the request comes from a bot or an automated agent. | cf.bot_management.score | Integer | cf.bot_management.score le 10 |
| JA3 Fingerprint* | Provides an SSL/TLS fingerprint to help you identify potential bot requests. | cf.bot_management.ja3_hash | String | cf.bot_management.ja3_hash eq \"e7d705a3286e19ea42f587b344ee6865\" |
| JA4 Fingerprint* | Provides a normalized TLS client fingerprint to help identify and correlate requests from the same or similar client implementations. JA4 is a structured string. A value can look like t13d1516h2_55b375c5d22e_0d5f5b7c. | cf.bot_management.ja4 | String | cf.bot_management.ja4 eq \"t13d1516h2_55b375c5d22e_0d5f5b7c\" |
| Verified Bot* | When true, this field indicates the request originated from a known good bot or crawler, the same information as cf.client.bot. This field requires Bot Management; use cf.client.bot instead, which returns the same result without Bot Management. | cf.bot_management.verified_bot | Boolean | cf.bot_management.verified_bot |
| Authentication Detected | Indicates whether Cloudflare detected authentication credentials in the request. | cf.waf.auth_detected | Boolean | cf.waf.auth_detected |
| Username Leaked | Indicates whether the username detected in the request was previously leaked. | cf.waf.credential_check.username_leaked | Boolean | cf.waf.credential_check.username_leaked |
| Password Leaked | Indicates whether the password detected in the request was previously leaked. | cf.waf.credential_check.password_leaked | Boolean | cf.waf.credential_check.password_leaked |
| Username and Password Leaked | Indicates whether the username-password pair detected in the request was previously leaked. | cf.waf.credential_check.username_and_password_leaked | Boolean | cf.waf.credential_check.username_and_password_leaked |
| Similar Credentials Leaked | Indicates whether a similar version of the username and password credentials detected in the request was previously leaked. | cf.waf.credential_check.username_password_similar | Boolean | cf.waf.credential_check.username_password_similar |
Fields marked with an asterisk begin with cf.bot_management. To use cf.bot_management.* fields, you must implement your own Cloudflare account (o2o) with Bot Management enabled. For verified bot detection, use cf.client.bot instead of cf.bot_management.verified_bot. Both fields return true when a request comes from a known, trusted bot or crawler (such as Googlebot or Bingbot), but cf.client.bot doesn’t require Bot Management. Use cf.client.bot and cf.verified_bot_category to allow, challenge, block, or rate limit traffic at the edge, including AI crawlers.
Note
Leaked Credentials Detection and the SLAS login API: Leaked Credentials Detection scans the Authorization header for HTTP Basic Authentication credentials. Use the cf.waf.credential_check.* fields on SLAS login endpoints (for example, /shopper/auth/v1/organizations/{organizationId}/oauth2/login) and on storefront login endpoints (for example, /Account-Login).
Note
j
