{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/cloudflare-access-bypass-service-auth-boundary/", "item": { "id": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/", "slug": "cloudflare-access-bypass-service-auth-boundary", "url": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary.md", "json": "https://update.dsesecurity.com/api/v1/posts/cloudflare-access-bypass-service-auth-boundary/" }, "title": "Keep machine access authenticated instead of creating a Cloudflare Access Bypass", "summary": "Bypass removes Access enforcement and its request logging for matching traffic.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:22+00:00", "modified_at": "2026-10-15T13:36:16+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 262, "potentially_affected": "This applies to Cloudflare Access application policies. Zone security settings may still apply to bypassed traffic, but they do not supply the Access identity enforcement removed by the Bypass action.", "dse_recommendation": "DSE recommends documenting why an endpoint needs public access or machine authentication before selecting an action.", "primary_source": { "name": "Cloudflare — Access policies", "url": "https://developers.cloudflare.com/cloudflare-one/access-controls/policies/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Bypass removes Access enforcement and its request logging for matching traffic.

\n

Source facts

\n

Cloudflare documents Bypass as disabling Access enforcement for matching traffic. Such traffic does not receive Access security controls and its requests are not logged by Access. Bypass also does not support identity-based selectors. Service Auth is a different action for authentication without an identity-provider login, including service tokens or mutual TLS. Access remains deny by default for traffic that does not satisfy an allowing policy; a Block rule alone does not grant everybody else entry. These actions therefore solve materially different access requirements.

\n

Source: Cloudflare — Access policies.

\n

Applicability

\n

This applies to Cloudflare Access application policies. Zone security settings may still apply to bypassed traffic, but they do not supply the Access identity enforcement removed by the Bypass action.

\n

DSE recommendation

\n

DSE recommends documenting why an endpoint needs public access or machine authentication before selecting an action. Use a narrowly defined service-authentication design for automation that can present approved credentials. Reserve any public exception for the exact endpoint and business purpose reviewed by its owner. Check overlapping policies and application paths before saving. Keep an exception register with an owner and expiry review, and verify the resulting evidence trail rather than assuming a bypassed request will appear beside authenticated requests.

\n

Verification

\n

In a test application, compare an authorized automation request, a request with missing credentials, and an unrelated path. Review the actual policy decision and available logs. Confirm that a public exception exposes only the intended resource and remove the test exception afterward.

\n

Official reference

\n

Cloudflare — Access policies. Reviewed October 15, 2026.

", "content_text": "Bypass removes Access enforcement and its request logging for matching traffic.\nSource facts\nCloudflare documents Bypass as disabling Access enforcement for matching traffic. Such traffic does not receive Access security controls and its requests are not logged by Access. Bypass also does not support identity-based selectors. Service Auth is a different action for authentication without an identity-provider login, including service tokens or mutual TLS. Access remains deny by default for traffic that does not satisfy an allowing policy; a Block rule alone does not grant everybody else entry. These actions therefore solve materially different access requirements.\nSource: Cloudflare — Access policies.\nApplicability\nThis applies to Cloudflare Access application policies. Zone security settings may still apply to bypassed traffic, but they do not supply the Access identity enforcement removed by the Bypass action.\nDSE recommendation\nDSE recommends documenting why an endpoint needs public access or machine authentication before selecting an action. Use a narrowly defined service-authentication design for automation that can present approved credentials. Reserve any public exception for the exact endpoint and business purpose reviewed by its owner. Check overlapping policies and application paths before saving. Keep an exception register with an owner and expiry review, and verify the resulting evidence trail rather than assuming a bypassed request will appear beside authenticated requests.\nVerification\nIn a test application, compare an authorized automation request, a request with missing credentials, and an unrelated path. Review the actual policy decision and available logs. Confirm that a public exception exposes only the intended resource and remove the test exception afterward.\nOfficial reference\nCloudflare — Access policies. Reviewed October 15, 2026.", "content_markdown": "Bypass removes Access enforcement and its request logging for matching traffic.\n\n## Source facts\n\nCloudflare documents Bypass as disabling Access enforcement for matching traffic. Such traffic does not receive Access security controls and its requests are not logged by Access. Bypass also does not support identity-based selectors. Service Auth is a different action for authentication without an identity-provider login, including service tokens or mutual TLS. Access remains deny by default for traffic that does not satisfy an allowing policy; a Block rule alone does not grant everybody else entry. These actions therefore solve materially different access requirements.\n\nSource: [Cloudflare — Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/).\n\n## Applicability\n\nThis applies to Cloudflare Access application policies. Zone security settings may still apply to bypassed traffic, but they do not supply the Access identity enforcement removed by the Bypass action.\n\n## DSE recommendation\n\nDSE recommends documenting why an endpoint needs public access or machine authentication before selecting an action. Use a narrowly defined service-authentication design for automation that can present approved credentials. Reserve any public exception for the exact endpoint and business purpose reviewed by its owner. Check overlapping policies and application paths before saving. Keep an exception register with an owner and expiry review, and verify the resulting evidence trail rather than assuming a bypassed request will appear beside authenticated requests.\n\n## Verification\n\nIn a test application, compare an authorized automation request, a request with missing credentials, and an unrelated path. Review the actual policy decision and available logs. Confirm that a public exception exposes only the intended resource and remove the test exception afterward.\n\n## Official reference\n\n[Cloudflare — Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/", "url": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep machine access authenticated instead of creating a Cloudflare Access Bypass", "item": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/#article", "identifier": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/", "url": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/", "headline": "Keep machine access authenticated instead of creating a Cloudflare Access Bypass", "description": "Bypass removes Access enforcement and its request logging for matching traffic.", "abstract": "Bypass removes Access enforcement and its request logging for matching traffic.", "articleBody": "Bypass removes Access enforcement and its request logging for matching traffic.\nSource facts\nCloudflare documents Bypass as disabling Access enforcement for matching traffic. Such traffic does not receive Access security controls and its requests are not logged by Access. Bypass also does not support identity-based selectors. Service Auth is a different action for authentication without an identity-provider login, including service tokens or mutual TLS. Access remains deny by default for traffic that does not satisfy an allowing policy; a Block rule alone does not grant everybody else entry. These actions therefore solve materially different access requirements.\nSource: Cloudflare — Access policies.\nApplicability\nThis applies to Cloudflare Access application policies. Zone security settings may still apply to bypassed traffic, but they do not supply the Access identity enforcement removed by the Bypass action.\nDSE recommendation\nDSE recommends documenting why an endpoint needs public access or machine authentication before selecting an action. Use a narrowly defined service-authentication design for automation that can present approved credentials. Reserve any public exception for the exact endpoint and business purpose reviewed by its owner. Check overlapping policies and application paths before saving. Keep an exception register with an owner and expiry review, and verify the resulting evidence trail rather than assuming a bypassed request will appear beside authenticated requests.\nVerification\nIn a test application, compare an authorized automation request, a request with missing credentials, and an unrelated path. Review the actual policy decision and available logs. Confirm that a public exception exposes only the intended resource and remove the test exception afterward.\nOfficial reference\nCloudflare — Access policies. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:22+00:00", "dateModified": "2026-10-15T13:36:16+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep machine access authenticated instead of creating a Cloudflare Access Bypass" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 262, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Access policies", "url": "https://developers.cloudflare.com/cloudflare-one/access-controls/policies/" } } ] } }