CCloud Releases
Home
Following

Cloud Releases

Service catalogues and updates come from each provider's public product listing and announcements.

Explore

  • Home
  • Latest updates
  • Following

About

  • About
  • Contact
  • Privacy Policy
  • Terms of Use

Providers

  • Amazon Web Services
  • Microsoft Azure
  • Google Cloud
  • Cloudflare

Not affiliated with any cloud provider. Product names and logos belong to their owners.

  1. Providers
  2. ›Cloudflare
  3. ›Rules
  4. ›Update

Feature•Jan 27, 2026

Control request and response body buffering in Configuration Rules

RulesCloudflare · Core platform

You can now control how Cloudflare buffers HTTP request and response bodies using two new settings in Configuration Rules.

Request body buffering

Controls how Cloudflare buffers HTTP request bodies before forwarding them to your origin server:

Mode · Behavior

Standard (default) · Cloudflare can inspect a prefix of the request body for enabled functionality such as WAF and Bot Management.

Full · Buffers the entire request body before sending to origin.

None · No buffering — the request body streams directly to origin without inspection.

Response body buffering

Controls how Cloudflare buffers HTTP response bodies before forwarding them to the client:

Mode · Behavior

Standard (default) · Cloudflare can inspect a prefix of the response body for enabled functionality.

None · No buffering — the response body streams directly to the client without inspection.

Caution

Setting body buffering to None may break security functionality that requires body inspection, including the Web Application Firewall (WAF) and Bot Management. Ensure that any paths where you disable buffering do not require security inspection.

API example

{ "action": "set_config", "action_parameters": { "request_body_buffering": "standard", "response_body_buffering": "none" } }

For more information, refer to Configuration Rules.

Read the original announcement↗

More from Rules

All Rules updates →
  1. Failed detections field available in Rules

    You can now use cf.appsec.request.failed_detections to control how your rules handle requests when a security detection reports a failure.

    Rules•Feature•Oct 9, 2026
  2. hash_in_range() is globally available for HTTP products

    hash_in_range() is globally available for HTTP products on all plans. It hashes fields into an integer within a specified range. Use this result to select a portion of requests.

    Rules•Feature•Oct 2, 2026
  3. Handle missing values with coalesce()

    The coalesce() function returns the first argument that is not nil. Use it to provide a fallback in rule expressions:

    Rules•Feature•Oct 1, 2026
  4. Compare dynamic values in Rules expressions

    Cloudflare Rules expressions now support dynamic values on both sides of equality and ordering comparisons. You can compare request fields or function results with one another.

    Rules•Feature•Oct 1, 2026
  5. concat() now supports up to 32 arguments

    The concat() function in Cloudflare Rules now accepts up to 32 arguments, increased from 16. This allows you to build richer dynamic values directly in Rules expressions and simplify configurations that combine request data.

    Rules•Feature•Sep 22, 2026