Encrypted WAF Logging: Keeping the Payload Private

Cloudflare's Web Application Firewall (WAF) intercepts over 72 billion malicious requests daily. When a rule fires, admins typically review the event using the dashboard's security event log, which shows standard metadata such as the URL and query parameters. But sometimes, a match depends on a field that isn't logged by default—an HTTP header, a cookie, or a fragment of a POST body.

Logging those fields in cleartext is not an option. Headers routinely carry session cookies, and request bodies frequently contain credentials or other personal data. Cloudflare treats such information as a toxic asset and intentionally limits access. Yet visibility into the exact matched content is a core requirement for tuning firewall rules.

The solution is a new feature: encrypted matched payload logging. When a WAF rule triggers on a specific field, that field is encrypted before it enters the logs. Because the encryption key is customer-provided, only the customer can decrypt the matched data—not Cloudflare staff, despite the fact that all logs are already encrypted at rest. This creates a second, customer-controlled encryption layer for sensitive matched fields.

Encryption with HPKE

The feature relies on Hybrid Public Key Encryption (HPKE), a standard developed in part by Cloudflare and the Crypto Forum Research Group (CFRG) at the IETF. HPKE combines the speed of symmetric encryption with the practicality of asymmetric key exchange.

  • Key generation: Admins can generate a key pair directly from the Cloudflare dashboard or use the open-source command line utility.
  • Key custody: Cloudflare never stores the private key. Customers are solely responsible for safeguarding it. Losing the private key means the encrypted payloads become unrecoverable, though rotating keys is supported for future logs.
  • Decryption options: Payloads can be decrypted either from the Security Events log in the dashboard (using the customer's browser for client-side decryption, keeping the private key local) or via the command line utility.

Once enabled, encrypted payloads appear in the metadata field of the security event log as base64 blobs. For example, a rule that matches against the REQUEST_HEADERS:REFERER field would log an encrypted version of that header's value, allowing admins to confirm exactly why the request was flagged.

Rollout and Access Control

The feature is initially rolling out to Enterprise customers over the coming months. Enterprise customers who need it sooner can request early access from their account team. Configuration requires Super Administrator privileges on the Cloudflare dashboard, ensuring that only authorized application owners can set up or modify encrypted payload logging. Anyone without the private key—including Cloudflare personnel—cannot decrypt the logged payloads.