Enforce positive security with Cloudflare Application Profiles
Cloudflare launches Application Profiles, learning expected HTTP request structures to enforce positive security and block non-conforming requests.
Cloudflare introduced Application Profiles (Schema Profiles), extending its positive security model from APIs to web applications. The feature learns each operation's expected request structure and data types, then deploys always-on validation that flags non-conforming requests as metadata for analytics or blocking via Security Rules. It is in closed beta for invited Enterprise customers without API Security; API Security customers already have access. The approach aims to shrink attack surface against LLM-assisted attacks like SQL injection, XSS, and RCE.
- Positive security blocks requests that deviate from learned structure, not just known signatures
- Learns data types, ranges, enums, and character classes per operation from observed traffic
- Closed beta for invited Enterprise customers; API Security customers already have access
- Cloudflare recommends observation mode before enforcement to avoid blocking valid traffic
- Organizations
- Cloudflare
From the original article
9 min read at blog.cloudflare.com
Cloudflare learns the structure of your HTTP requests and identifies deviations. You can add a positive security layer that helps reduce attack surface as AI makes it easier for attackers to generate and vary payloads.
By Daniele Molteni · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.