Cloudflare

Get better visibility for the WAF with payload logging

Nov 24, 2025Paschal Obba
Get better visibility for the WAF with payload logging
SummaryAI, from the source post

This post introduces and details improvements to Cloudflare's WAF payload logging feature. The core contribution is the enhancement of the payload logging compiler, built on Wirefilter, to provide more precise and reduced logging. Key technical advancements include: 1. Partial evaluation of array fields (e.g., `http.request.headers.names[*]`) to log only matching elements, significantly reducing log volume. 2. Improved handling of 'partial' match operators (like 'contains', 'in', 'matches') to log only the specific matching parts of a field rather than the entire field. 3. Logging 'before' and 'after' context for partial matches to provide clearer debugging information and further reduce log volume. The post also explains the underlying Wirefilter architecture and the encryption of logs for customer privacy.

More from the Website Security & Threat Management trail