Search code examples
cloudflare

Using Clouflare Access rules for application on wildcard domain relying on REST API

We are using Cloudflare Access to control who has access to our staging environment. We use a simple Google Auth to identify users on our team.

The policy defined is like this for URL *.mydomain.com:

  • include email ending @myteam.com

The issue is that on the URL in question we're using a wildcard because we have various apps running like:

  • dashboard.mydomain.com
  • client.mydomain.com

And that causes a problem when say one app is communicating with the other via a REST API. The requests made from client.mydomain.com to dashboard.mydomain.com/api are being held up by Cloudflare, ie. redirecting to the auth page.

I've tried add another policy for dashboard.mydomain.com/api and allow EVERYONE (just to try out) and it didn't work:

screenshot

Is my idea of how to set this up correct?

Solution

  • Your configuration looks alright, I believe what is probably happening is the authentication (cookie) isn't being passed to your second subdomain during the API request. This can usually be traced back to a CORS issue.

    https://developers.cloudflare.com/cloudflare-one/policies/zero-trust/cors/

    Specifically, your API subdomain may not have the Access-Control-Allow-Credentials properly set to allow sending cookies. Before enabling, you'll want to ensure you'll also want to ensure the other CORS headers are properly setup to restrict which sites can allow requests (reduce risk of XSS attack now that you are allowing authenticated requests).