Functions reference

any(Array<Boolean>) Boolean

• Returns true when the comparison operator in the argument returns true for any of the values in the argument array. Returns false otherwise.

• Example:
  

  any(url_decode(http.request.body.form.values[*])[*] contains "an xss attack")

all(Array<Boolean>) Boolean

• Returns true when the comparison operator in the argument returns true for all values in the argument array. Returns false otherwise.

• Example:
  

  all(http.request.headers["content-type"][*] == "application/json")

concat(String | Integer | bytes | Array elements) String

• Takes a comma-separated list of values. Concatenates the argument values into a single String.

• Example:
  

  concat("String1"," ","String",2) == "String1 String2"

ends_with(sourceString, substringString) Boolean

• Returns true when the source ends with a given substring. Returns false otherwise. The source cannot be a literal value (for example, "foo").

• Example:
  If http.request.uri.path is "/welcome.html", then ends_with(http.request.uri.path, ".html") will return true.

len(String | bytes) Integer

• Returns the byte length of a String or Bytes field.

• Example:
  

  len(http.host)

lookup_json_string(fieldString, keyString) String

• Returns the string value associated with the supplied key in field.
  The field must be a string representation of a valid JSON object.
  The key can be an attribute name, a zero-based position number in a JSON array, or a combination of these two options (as extra function parameters), while following the hierarchy of the JSON object to obtain a specific value.

• Examples:

  A) Given the following JSON object contained in the http.request.body.raw field:
  { "company": "cloudflare", "product": "rulesets" }
  The following expression will return true:
  lookup_json_string(http.request.body.raw, "company") == "cloudflare"

  B) Given the following nested object:
  { "network": { "name": "cloudflare" } }
  The following expression will return true:
  lookup_json_string(http.request.body.raw, "network", "name") == "cloudflare"

  C) Given the following JSON array at the root level:
  ["other_company", "cloudflare"]
  The following expression will return true:
  lookup_json_string(http.request.body.raw, 1) == "cloudflare"

  D) Given the following array in a JSON object attribute:
  { "networks": ["other_company", "cloudflare"] }
  The following expression will return true:
  lookup_json_string(http.request.body.raw, "networks", 1) == "cloudflare"

  E) Given the following root-level array of JSON objects:
  [{ "network": "other_company" }, { "network": "cloudflare" }]
  The following expression will return true:
  lookup_json_string(http.request.body.raw, 1, "network") == "cloudflare"

lower(String) String

• Converts a string field to lowercase. Only uppercase ASCII bytes are converted. All other bytes are unaffected.

• Example:
  

  lower(http.host) == "www.cloudflare.com"

regex_replace(sourceString, regular_expressionString, replacementString) String

• Replaces a part of a source string matched by a regular expression with a replacement string, returning the result. The replacement string can contain references to regular expression capture groups.

• Examples:

  Literal match replace:
  regex_replace("/foo/bar", "/bar$", "/baz") == "/foo/baz"

  If there is no match, the input string does not change:
  regex_replace("/x", "^/y$", "/mumble") == "/x"

  Match is case sensitive by default:
  regex_replace("/foo", "^/FOO$", "/x") == "/foo"

  When there are multiple matches, only one replacement occurs (the first one):
  regex_replace("/a/a", "/a", "/b") == "/b/a"

  Escape a $ in the replacement string by prefixing it with another $:
  regex_replace("/b", "^/b$", "/b$$") == "/b$"

  Replace with capture groups:
  regex_replace("/foo/a/path", "^/foo/([^/]*)/(.*)$", "/bar/${2}/${1}") == "/bar/path/a/"

  Create capture groups by putting part of the regular expression in parentheses. Then, reference a capture group using ${<num>} in the replacement string, where <num> is the number of the capture group.

remove_bytes(bytes) bytes

• Returns a new byte array with all the occurrences of the given bytes removed.

• Example:
  

  remove_bytes(http.host, "\x2e\x77") == "cloudflarecom"

starts_with(sourceString, substringString) Boolean

• Returns true when the source starts with a given substring. Returns false otherwise. The source cannot be a literal value (for example, "foo").

• Example:
  If http.request.uri.path is "/blog/first-post", then starts_with(http.request.uri.path, "/blog") will return true.

to_string(Integer | Boolean | IP address) String

• Returns the string representation of an Integer, Boolean, or IP address value.

• Examples:

  to_string(cf.bot_management.score) == '5'
  to_string(ssl) == 'true'

upper(String) String

• Converts a string field to uppercase. Only lowercase ASCII bytes are converted. All other bytes are unaffected.

• Example:
  

  upper(http.host) == “WWW.CLOUDFLARE.COM”

url_decode(String) String

• Decodes a URL formatted string, as in the following:

  • %20 and + decode to space characters

  • %E4%BD decodes to ä½

• Example:
  

  any(url_decode(http.request.body.form.values[*])[*] contains "an xss attack")

uuidv4(Bytes) String

• Generates a random UUIDv4 (Universally Unique Identifier, version 4) based on the given argument (a source of randomness). To obtain an array of random bytes, use the cf.random_seed field.

• Example:
  uuidv4(cf.random_seed) returns a UUIDv4 similar to 49887398-6bcf-485f-8899-f15dbef4d1d5

Key String literal

• Specifies the secret cryptographic key for validating the HMAC.

MessageMAC String

• Contains a concatenation of these HMAC elements: message, separator, timestamp, mac. For a definition and an example, refer to MessageMAC.

ttl Integer literal

• Defines the time-to-live for the HMAC token, expressed in seconds. Determines how long the token is valid, relative to the time it was issued.

currentTimeStamp Integer

• Represents the Unix timestamp when Cloudflare received the request, expressed in seconds. Pass the http.request.timestamp.sec field as an approximate value to this argument.

lengthOfSeparator Integer literal optional

• Specifies the length of the separator between the timestamp and the message in the MessageMAC. Expressed in bytes, with a default value of 0.

flags String literal optional

• When you set this optional argument to 's', the function expects the value of the base64-encoded mac in the MessageMAC argument to use the URL-safe character set with no padding.

• When you do not set the value of flags to 's', you must URL encode the base64 value for mac in the MessageMAC argument.