Leaked credentials detection now scans the Authorization request header for Basic Authentication credentials. Previously, the detection only inspected request bodies, query strings, and headers for well-known web applications or custom detection locations, which meant credentials sent through HTTP Basic Authentication were not covered by default.
This new default scan location decodes the Authorization: Basic <credentials> header and compares the extracted username and password against Cloudflare’s database of leaked credentials, the same way as other default scan locations. Matches populate the existing leaked credentials fields, such as cf.waf.credential_check.password_leaked, and trigger the Exposed-Credential-Check managed transform header if configured, so you can reuse existing custom rules and rate limiting rules without changes.
This change was applied automatically for zones with leaked credentials detection enabled. No configuration changes are required.
For more information, refer to Leaked credentials detection.
Source: Cloudflare
