# Separate Access authentication evidence from HTTP activity evidence

> A successful login record does not list every action taken inside an application.

- Canonical URL: https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:27+00:00
- Modified: 2026-10-15T13:36:17+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

A successful login record does not list every action taken inside an application.

## Potentially affected

This concerns evidence available from Cloudflare Access and associated request logging. Application database changes, browser-only interactions, and business approvals may require separate application audit records.

## DSE recommendation

DSE recommends writing the investigation question before choosing a log source.

## Article

A successful login record does not list every action taken inside an application.

## Source facts

Cloudflare Access distinguishes authentication audit logs from per-request audit logs. Authentication logs describe login attempts and their outcomes; they do not capture the user’s actions during a self-hosted or SaaS application session. Per-request records can describe HTTP requests to protected paths, but interactions entirely within the browser produce no new server request to record. The documentation also separates identity-based and non-identity authentication logs, with different retrieval methods. Detailed HTTP logging and export features have their own availability requirements.

Source: [Cloudflare — Access logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/).

## Applicability

This concerns evidence available from Cloudflare Access and associated request logging. Application database changes, browser-only interactions, and business approvals may require separate application audit records.

## DSE recommendation

DSE recommends writing the investigation question before choosing a log source. For “who signed in,” preserve the authentication decision and application identifier. For “what was requested,” review the available request dataset and correlate timestamps and request identifiers. For “what changed,” obtain the application’s own audit trail. Document plan, retention, and export constraints before an incident, and protect any exported user or IP information. Do not describe a login-only export as a complete record of a user’s application activity.

## Verification

With a controlled test account, sign in and perform an approved server-backed action plus a browser-only interaction. Compare the authentication, request, and application records. Document expected gaps and confirm that the evidence collection procedure can retrieve the relevant period without assuming all events share one dashboard.

## Official reference

[Cloudflare — Access logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/). Reviewed October 15, 2026.

## Primary reference

- Name: Cloudflare — Access logs
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate Access authentication evidence from HTTP activity evidence,” DSE Security, https://update.dsesecurity.com/updates/cloudflare-access-authentication-versus-request-logs/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.