Cloudflare 中文文档
Cloudflare Zero Trust
Cloudflare 中文文档
Cloudflare Zero Trust
编辑这个页面
跳转官方原文档
Set theme to dark (⇧+D)
  1. Products
  2. Cloudflare Zero Trust
  3. ...
  4. Authorization cookie
  5. Validate JWTs

Validate JWTs

When Cloudflare sends a request to your origin, the request will include an application token as a Cf-Access-Jwt-Assertion request header and as a CF_Authorization cookie.

Cloudflare signs the token with a key pair unique to your account. You should validate the token with your public key to ensure that the request came from Access and not a malicious third party.

​​ Access signing keys

The public key for the signing key pair is located at https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/certs, where <your-team-name> is your Zero Trust team name.

By default, Access rotates the signing key every 6 weeks. This means you will need to programmatically or manually update your keys as they rotate. Previous keys remain valid for 7 days after rotation to allow time for you to make the update.

You can also manually rotate the key using the API. This can be done for testing or security purposes.

As shown in the example below, https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/certs contains two public keys: the current key used to sign all new tokens, and the previous key that has been rotated out.

  • keys: both keys in JWK format
  • public_cert: current key in PEM format
  • public_certs: both keys in PEM format

​​ Verify the JWT manually

To verify the token manually:

  1. Copy the JWT from the CF_Authorization cookie or from the Cf-Access-Jwt-Assertion request header.

  2. Go to jwt.io.

  3. Select the RS256 algorithm.

  4. Paste the JWT into the Encoded box.

  5. Get the kid value located in the Header box.

  6. Get your public key:

    1. Go to https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/certs.
    2. Under public_certs, locate the entry with the kid value you found in Step 5.
    3. Copy the cert value.

  7. In the Verify Signature box, paste the cert value into the Public Key field.

  8. Ensure that the signature says verified.

You can now trust that this request was sent by Access.

​​ Programmatic verification

You can run an automated script on your origin server to validate incoming requests. The provided sample code gets the application token from a request and checks its signature against your public key. You will need to insert your own team domain and Application Audience (AUD) tag into the sample code.

​​ Get your AUD tag

  1. In Zero Trust, go to Access > Applications.
  2. Select Configure for your application.
  3. On the Overview tab, copy the Application Audience (AUD) Tag.

You can now paste the AUD into your token validation script.

​​ Golang example

​​ Python example

pip install the following:

  • flask
  • requests
  • PyJWT
  • cryptography

​​ JavaScript example