Question
Which policy takes precedence when overlapping Allow and Bypass rules are applied to a single application path?
Ash Indigo
0 reputation · 21 Feb 2022, 06:18 UTC
views
Loading…
0 reputation · 21 Feb 2022, 06:18 UTC
Cloudflare Access utilizes a set of policies to manage authentication layers for internal resources. When configuring these policies, administrators can define Allow rules to restrict access to specific identity providers and Bypass rules to permit traffic without authentication for certain criteria, such as specific IP ranges.
A design uncertainty arises when a single application path is targeted by both an Allow policy and a Bypass policy that both evaluate to true for a given request. Because the security goal is to prevent accidental public exposure, the resolution order of these overlapping rules is critical.
Does Cloudflare prioritize the Bypass rule over the Allow rule in this scenario? If so, what is the documented behavior for ensuring that an Allow requirement remains the primary gatekeeper for a specific path?
When an Allow rule and a Bypass rule both evaluate to true for a single application path, Cloudflare Access applies the Bypass rule first. The traffic is exempted from authentication even though an Allow rule also matches.
Cloudflare Access evaluates policies in the order they appear in the policy list. The engine stops at the first rule whose conditions match the request and applies that rule’s action. In the default rule‑order table, Bypass actions are positioned higher than Allow actions, so a matching Bypass overrides any overlapping Allow.
cloudflareBypass and Allow policies for the target application path.Allow rule to be the gatekeeper, either:Allow policy above the Bypass policy (if your plan permits custom ordering), orBypass rule so it no longer matches the path.Confirm whether your Cloudflare Access tenant allows custom rule ordering (some older or limited plans enforce a fixed precedence). If ordering cannot be changed, the Bypass rule will always take precedence, and the only way to enforce Allow gating is to adjust the Bypass rule’s scope.
Use comments to ask for clarification. Post a solution as an answer.
33,775 reputation · 21 Feb 2022, 08:56 UTC
Cloudflare Access processes rules in a fixed priority list: Bypass rules are evaluated first, followed by Allow and then Denys. Within each category the order can be adjusted in the policy list, but the category order itself is immutable on most plans.
| Category | Effect if matched |
|---|---|
| Bypass | Immediate access – no authentication required |
| Allow | Authentication required; passes if identity matches |
| Deny | Request blocked regardless of other rules |
Exclude clause in the Bypass rule to leave the protected segment out.action field after a test request.Because Bypass takes precedence, a broad Bypass can unintentionally expose internal paths; tightening its scope is the safest mitigation.