{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/cloudflare-access-authentication-versus-request-logs/", "item": { "id": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/", "slug": "cloudflare-access-authentication-versus-request-logs", "url": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs.md", "json": "https://update.dsesecurity.com/api/v1/posts/cloudflare-access-authentication-versus-request-logs/" }, "title": "Separate Access authentication evidence from HTTP activity evidence", "summary": "A successful login record does not list every action taken inside an application.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:27+00:00", "modified_at": "2026-10-15T13:36:17+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 260, "potentially_affected": "This concerns evidence available from Cloudflare Access and associated request logging. Application database changes, browser-only interactions, and business approvals may require separate application audit records.", "dse_recommendation": "DSE recommends writing the investigation question before choosing a log source.", "primary_source": { "name": "Cloudflare — Access logs", "url": "https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A successful login record does not list every action taken inside an application.

\n

Source facts

\n

Cloudflare Access distinguishes authentication audit logs from per-request audit logs. Authentication logs describe login attempts and their outcomes; they do not capture the user’s actions during a self-hosted or SaaS application session. Per-request records can describe HTTP requests to protected paths, but interactions entirely within the browser produce no new server request to record. The documentation also separates identity-based and non-identity authentication logs, with different retrieval methods. Detailed HTTP logging and export features have their own availability requirements.

\n

Source: Cloudflare — Access logs.

\n

Applicability

\n

This concerns evidence available from Cloudflare Access and associated request logging. Application database changes, browser-only interactions, and business approvals may require separate application audit records.

\n

DSE recommendation

\n

DSE recommends writing the investigation question before choosing a log source. For “who signed in,” preserve the authentication decision and application identifier. For “what was requested,” review the available request dataset and correlate timestamps and request identifiers. For “what changed,” obtain the application’s own audit trail. Document plan, retention, and export constraints before an incident, and protect any exported user or IP information. Do not describe a login-only export as a complete record of a user’s application activity.

\n

Verification

\n

With a controlled test account, sign in and perform an approved server-backed action plus a browser-only interaction. Compare the authentication, request, and application records. Document expected gaps and confirm that the evidence collection procedure can retrieve the relevant period without assuming all events share one dashboard.

\n

Official reference

\n

Cloudflare — Access logs. Reviewed October 15, 2026.

", "content_text": "A successful login record does not list every action taken inside an application.\nSource facts\nCloudflare Access distinguishes authentication audit logs from per-request audit logs. Authentication logs describe login attempts and their outcomes; they do not capture the user’s actions during a self-hosted or SaaS application session. Per-request records can describe HTTP requests to protected paths, but interactions entirely within the browser produce no new server request to record. The documentation also separates identity-based and non-identity authentication logs, with different retrieval methods. Detailed HTTP logging and export features have their own availability requirements.\nSource: Cloudflare — Access logs.\nApplicability\nThis concerns evidence available from Cloudflare Access and associated request logging. Application database changes, browser-only interactions, and business approvals may require separate application audit records.\nDSE recommendation\nDSE recommends writing the investigation question before choosing a log source. For “who signed in,” preserve the authentication decision and application identifier. For “what was requested,” review the available request dataset and correlate timestamps and request identifiers. For “what changed,” obtain the application’s own audit trail. Document plan, retention, and export constraints before an incident, and protect any exported user or IP information. Do not describe a login-only export as a complete record of a user’s application activity.\nVerification\nWith a controlled test account, sign in and perform an approved server-backed action plus a browser-only interaction. Compare the authentication, request, and application records. Document expected gaps and confirm that the evidence collection procedure can retrieve the relevant period without assuming all events share one dashboard.\nOfficial reference\nCloudflare — Access logs. Reviewed October 15, 2026.", "content_markdown": "A successful login record does not list every action taken inside an application.\n\n## Source facts\n\nCloudflare Access distinguishes authentication audit logs from per-request audit logs. Authentication logs describe login attempts and their outcomes; they do not capture the user’s actions during a self-hosted or SaaS application session. Per-request records can describe HTTP requests to protected paths, but interactions entirely within the browser produce no new server request to record. The documentation also separates identity-based and non-identity authentication logs, with different retrieval methods. Detailed HTTP logging and export features have their own availability requirements.\n\nSource: [Cloudflare — Access logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/).\n\n## Applicability\n\nThis concerns evidence available from Cloudflare Access and associated request logging. Application database changes, browser-only interactions, and business approvals may require separate application audit records.\n\n## DSE recommendation\n\nDSE recommends writing the investigation question before choosing a log source. For “who signed in,” preserve the authentication decision and application identifier. For “what was requested,” review the available request dataset and correlate timestamps and request identifiers. For “what changed,” obtain the application’s own audit trail. Document plan, retention, and export constraints before an incident, and protect any exported user or IP information. Do not describe a login-only export as a complete record of a user’s application activity.\n\n## Verification\n\nWith a controlled test account, sign in and perform an approved server-backed action plus a browser-only interaction. Compare the authentication, request, and application records. Document expected gaps and confirm that the evidence collection procedure can retrieve the relevant period without assuming all events share one dashboard.\n\n## Official reference\n\n[Cloudflare — Access logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/", "url": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate Access authentication evidence from HTTP activity evidence", "item": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/#article", "identifier": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/", "url": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/", "headline": "Separate Access authentication evidence from HTTP activity evidence", "description": "A successful login record does not list every action taken inside an application.", "abstract": "A successful login record does not list every action taken inside an application.", "articleBody": "A successful login record does not list every action taken inside an application.\nSource facts\nCloudflare Access distinguishes authentication audit logs from per-request audit logs. Authentication logs describe login attempts and their outcomes; they do not capture the user’s actions during a self-hosted or SaaS application session. Per-request records can describe HTTP requests to protected paths, but interactions entirely within the browser produce no new server request to record. The documentation also separates identity-based and non-identity authentication logs, with different retrieval methods. Detailed HTTP logging and export features have their own availability requirements.\nSource: Cloudflare — Access logs.\nApplicability\nThis concerns evidence available from Cloudflare Access and associated request logging. Application database changes, browser-only interactions, and business approvals may require separate application audit records.\nDSE recommendation\nDSE recommends writing the investigation question before choosing a log source. For “who signed in,” preserve the authentication decision and application identifier. For “what was requested,” review the available request dataset and correlate timestamps and request identifiers. For “what changed,” obtain the application’s own audit trail. Document plan, retention, and export constraints before an incident, and protect any exported user or IP information. Do not describe a login-only export as a complete record of a user’s application activity.\nVerification\nWith a controlled test account, sign in and perform an approved server-backed action plus a browser-only interaction. Compare the authentication, request, and application records. Document expected gaps and confirm that the evidence collection procedure can retrieve the relevant period without assuming all events share one dashboard.\nOfficial reference\nCloudflare — Access logs. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:27+00:00", "dateModified": "2026-10-15T13:36:17+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate Access authentication evidence from HTTP activity evidence" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 260, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Access logs", "url": "https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/" } } ] } }