Cloudflare Security Lab: Access, WAF, Tunnel, Tokens

It teaches how to secure a Cloudflare account and the things behind it: enforcing 2FA and keeping Super Administrators few, replacing the Global API key with scoped account API tokens, reading audit logs, putting Access in front of internal tools, using device posture, validating the Access token at the origin, connecting servers with Tunnel, locking down the origin, signing the zone with DNSSEC, and using the WAF and rate limiting.

Cloudflare says the Global API key has access to all of a user's resources with the same permissions as the user, cannot be limited by IP address or expiry, and is not recommended for new customers. Account API tokens can be limited to specific permissions and resources, with an optional expiry, and keep working when the person who created them leaves.

Sometimes, for a public endpoint such as a webhook path. Cloudflare warns that Bypass enforces no Access controls and does not log requests, and suggests Service Auth when you want enforcement and logging without user login. The lab scores a narrowly scoped, tested Bypass with origin-side checks as a last resort.

No. Cloudflare says Authenticated Origin Pulls does not apply to hostnames routed through a Tunnel, because a tunnel is outbound-only and has no inbound listener to present a certificate to; origin traffic is already authenticated by the tunnel's connector credentials.

No. Cloudflare notes that rate limiting is not designed to let a precise number of requests reach the origin, because counters can lag by a few seconds. Managed rules reduce exposure to known attack techniques, but they do not replace patching or application-side controls.