Cloudflare Access Policies

Cloudflare Access adds an identity-aware proxy in front of NodeKAT, allowing you to enforce authentication and authorization policies before users reach your application.

Overview

Access Policies enable you to:

• Require Authentication: Force users to log in via identity providers
• Granular Control: Define who can access what based on email, groups, or IP
• Audit Logging: Track all access attempts and actions
• Session Management: Control session duration and re-authentication

Prerequisites

• Cloudflare account with Zero Trust enabled
• Domain configured with Cloudflare Tunnels
• NodeKAT accessible via Cloudflare Tunnel
• Identity provider configured (GitHub, Google, Okta, etc.)

Setting Up Access

Step 1: Configure Identity Provider

1. Go to Zero Trust → Settings → Authentication
2. Click Add new under Login methods
3. Select your identity provider (GitHub recommended for development teams)
4. Follow the configuration steps

GitHub OAuth Setup:

1. Go to GitHub → Settings → Developer settings → OAuth Apps
2. Click New OAuth App
3. Fill in the details:
   • Application name: NodeKAT Access
   • Homepage URL: https://nodekat.yourdomain.com
   • Authorization callback URL: https://your-team.cloudflareaccess.com/cdn-cgi/access/callback
4. Copy Client ID and Client Secret to Cloudflare Access

Step 2: Create Access Application

1. Go to Zero Trust → Access → Applications
2. Click Add an application
3. Select Self-hosted
4. Configure:
   • Application name: NodeKAT
   • Session duration: 24 hours (or your preference)
   • Application domain: nodekat.yourdomain.com

Step 3: Create Access Policy

Create a policy to control who can access NodeKAT:

Allow Specific Users:

Action: Allow
Include:
  - Email: user1@example.com
  - Email: user2@example.com

Allow Organization Members:

Action: Allow
Include:
  - GitHub Organization: your-org

Require MFA:

Action: Allow
Include:
  - Email domain: example.com
Require:
  - Authentication method: MFA

IP-Based Access:

Action: Allow
Include:
  - IP range: 203.0.113.0/24

Policy Types

Allow Policies

Grant access to users who meet criteria:

• Email: Specific email addresses
• Email domain: All users from a domain
• IP range: Users from specific networks
• Country: Users from specific countries
• GitHub organization: Members of a GitHub org
• Google groups: Members of Google Workspace groups
• SAML attributes: Custom SAML assertions

Block Policies

Explicitly deny access:

Action: Block
Include:
  - Country: CN, RU, KP

Bypass Policies

Skip authentication for specific conditions:

Action: Bypass
Include:
  - IP range: 10.0.0.0/8

Useful for internal networks or service accounts.

Advanced Policy Configuration

Combining Rules

AND Logic:

Action: Allow
Include:
  - Email domain: example.com
Require:
  - Authentication method: MFA

OR Logic:

Action: Allow
Include:
  - Email: admin@example.com
  - Email: user@example.com

Time-Based Access

Restrict access to business hours:

Action: Allow
Include:
  - Email domain: example.com
Require:
  - Time: Monday-Friday 9:00-17:00

Device Posture

Require device compliance:

Action: Allow
Include:
  - Email domain: example.com
Require:
  - Device Posture: Disk encrypted
  - Device Posture: OS version current

Integration with NodeKAT

Pass User Headers

Cloudflare Access sends user identity as headers:

Header	Description
CF-Access-Client-Id	Client application ID
CF-Access-Jwt-Assertion	JWT with user claims
Cf-Access-Authenticated-User-Email	User’s email address

Configure NodeKAT

Update NodeKAT to trust these headers:

docker-compose.yml

environment:
  - TRUST_CLOUDFLARE_HEADERS=true
  - CLOUDFLARE_AUTH_HEADER=Cf-Access-Authenticated-User-Email

Validate JWT (Advanced)

For additional security, validate the JWT:

// NodeKAT middleware example
const jwt = require('jsonwebtoken');

function validateCloudflareJWT(req, res, next) {
  const token = req.headers['cf-access-jwt-assertion'];

  if (!token) {
    return res.status(401).json({ error: 'Missing authentication' });
  }

  try {
    const decoded = jwt.verify(token, process.env.CLOUDFLARE_JWT_PUBLIC_KEY);
    req.user = decoded;
    next();
  } catch (err) {
    return res.status(401).json({ error: 'Invalid token' });
  }
}

Get your JWT public key from:

https://<your-team>.cloudflareaccess.com/cdn-cgi/access/certs

Monitoring and Auditing

Access Logs

View all authentication attempts:

1. Go to Zero Trust → Logs → Access
2. Filter by user, application, or action
3. Export logs for compliance

Real-Time Notifications

Set up alerts for:

• Failed login attempts
• Blocked access attempts
• New device authentications

Configure in Zero Trust → Settings → Notifications

Troubleshooting

Infinite Redirect Loop

If you see an infinite redirect:

1. Check your tunnel configuration
2. Ensure noTLSVerify: true if using self-signed certificates
3. Verify the application domain matches exactly

Users Can’t Authenticate

1. Verify identity provider configuration
2. Check policy rules aren’t too restrictive
3. Review identity provider logs

JWT Validation Failures

1. Ensure you’re using the correct public key
2. Check token hasn’t expired
3. Verify algorithm matches (usually RS256)

Best Practices

1. Require MFA for all administrative access
2. Set session timeouts appropriately (8-24 hours)
3. Use IP restrictions for additional security layer
4. Monitor logs regularly for suspicious activity
5. Test policies with a small group before full rollout
6. Document your policies for team reference

Next Steps

• Configure WARP
• Add Slack Notifications
• Set up GitHub Integration