Cloudflare has updated its Web Application Firewall (WAF) to scan the Authorization request header for Basic Authentication credentials. This change addresses a gap in the default detection scope, which previously only inspected request bodies, query strings, and non-Basic headers.
When a request containing Authorization: Basic <credentials> is processed, Cloudflare decodes the header and compares the extracted username and password against its database of known leaked credentials. This behavior matches the logic used for other default scan locations.
Successful matches populate existing WAF fields, such as cf.waf.credential_check.password_leaked, and trigger the Exposed-Credential-Check managed transform header if configured. This allows administrators to continue using existing custom rules and rate limiting rules without modification.
The update is applied automatically for zones where leaked credentials detection is already enabled. No configuration changes are required from the user.