Backcountry Pilot • Cloudflare WAF blocking posts

Cloudflare WAF blocking posts

Have a problem with the website? Maybe you can find the answer here.
4 postsPage 1 of 1

Cloudflare WAF blocking posts

A few users have contacted me to report that when making a post, sometimes they will get a Cloudflare page stating something to the effect of their post was blocked. Cloudflare is our security shield on the site to prevent hacking.

If it happens to you, it's not because you were banned or blocked specifically. It's what's called a "false positive" in the Web Application Firewall (WAF.) Since so many website attacks come in the form of a specially formatted page request or form post, this special firewall attempts to analyze the request and block it if it finds some combination of characters that's consistent with an attack. Unfortunately sometimes plain language can contain some patterns that trigger the firewall I guess.

If you experience this, just hit the back button, copy your post text and send it to me in a PM. For some reason these don't get blocked when sending a PM. Odd.
Zzz offline
Janitorial Staff
User avatar
Posts: 2854
Joined: Fri Oct 08, 2004 11:09 pm
Location: northern
Aircraft: Swiveling desk chair
Half a century spent proving “it is better to be thought a fool than to open your mouth and remove all doubt.”

Re: Cloudflare WAF blocking posts

I will say that I see these most often when I've used an ampersand in my text. Often, by just substituting the word "and" instead, it resolves the issue. (Ampersands are sometimes used to embed SQL commands in urls, etc. and that may be why this particular character gets flagged more often.)
JP256 offline
Supporter
User avatar
Posts: 629
Joined: Mon Aug 31, 2015 1:52 pm
Location: Cedar Park
Aircraft: Rans S-6ES

Re: Cloudflare WAF blocking posts

JP256 wrote:I will say that I see these most often when I've used an ampersand in my text. Often, by just substituting the word "and" instead, it resolves the issue. (Ampersands are sometimes used to embed SQL commands in urls, etc. and that may be why this particular character gets flagged more often.)


Yep. It's a delimiting character when separating key/value pairs in a URL. Good thinking Jim.
Zzz offline
Janitorial Staff
User avatar
Posts: 2854
Joined: Fri Oct 08, 2004 11:09 pm
Location: northern
Aircraft: Swiveling desk chair
Half a century spent proving “it is better to be thought a fool than to open your mouth and remove all doubt.”

Re: Cloudflare WAF blocking posts

JP256 wrote:I will say that I see these most often when I've used an ampersand in my text. Often, by just substituting the word "and" instead, it resolves the issue. (Ampersands are sometimes used to embed SQL commands in urls, etc. and that may be why this particular character gets flagged more often.)


It doesn't like Em dashes either.
Oh-six-Lima offline
User avatar
Posts: 30
Joined: Thu May 13, 2021 11:31 pm
Location: Huntsville TX
Aircraft: Maule M-5-210C (on 2440s)

DISPLAY OPTIONS

4 postsPage 1 of 1

Who is online

Users browsing this forum: No registered users and 0 guests

Latest Features

Latest Knowledge Base