Soenneker.Cloudflare.Validators.Request.Functions 4.0.348

Prefix Reserved

There is a newer version of this package available.
See the version list below for details.

dotnet add package Soenneker.Cloudflare.Validators.Request.Functions --version 4.0.348

NuGet\Install-Package Soenneker.Cloudflare.Validators.Request.Functions -Version 4.0.348

This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.

<PackageReference Include="Soenneker.Cloudflare.Validators.Request.Functions" Version="4.0.348" />

For projects that support PackageReference, copy this XML node into the project file to reference the package.

<PackageVersion Include="Soenneker.Cloudflare.Validators.Request.Functions" Version="4.0.348" />
                    

                            Directory.Packages.props

<PackageReference Include="Soenneker.Cloudflare.Validators.Request.Functions" />
                    

                            Project file

For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.

paket add Soenneker.Cloudflare.Validators.Request.Functions --version 4.0.348

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

#r "nuget: Soenneker.Cloudflare.Validators.Request.Functions, 4.0.348"

#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.

#:package Soenneker.Cloudflare.Validators.Request.Functions@4.0.348

#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.

#addin nuget:?package=Soenneker.Cloudflare.Validators.Request.Functions&version=4.0.348
                    

                            Install as a Cake Addin

#tool nuget:?package=Soenneker.Cloudflare.Validators.Request.Functions&version=4.0.348
                    

                            Install as a Cake Tool

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

Soenneker.Cloudflare.Validators.Request.Functions

Validates the client certificate Azure App Service forwards to an isolated-worker Azure Function against packaged Cloudflare origin-pull certificate fingerprints.

Installation

dotnet add package Soenneker.Cloudflare.Validators.Request.Functions

Registration

using Soenneker.Cloudflare.Validators.Request.Functions.Registrars;

services.AddCloudflareRequestValidatorAsSingleton();

The package supplies cloudflareorigincerts.txt as a build resource. Set Cloudflare:RequestValidatorLog to true only when certificate-match debug logging is useful.

Usage

using Soenneker.Cloudflare.Validators.Request.Functions.Abstract;

bool fromCloudflare = await validator.IsFromCloudflare(
    request,
    functionContext.CancellationToken);

if (!fromCloudflare)
    return request.CreateResponse(HttpStatusCode.Forbidden);

IsFromCloudflare reads the first X-ARR-ClientCert value, decodes the certificate, calculates SHA-256 over its DER bytes, and compares that fingerprint case-insensitively with the packaged set. Missing, malformed Base64, and invalid certificate data return false.

Trust boundary

X-ARR-ClientCert is meaningful only when Azure App Service is the trusted TLS terminator and supplies the header from an authenticated client certificate. Ensure Authenticated Origin Pulls is enabled, App Service requires client certificates, and the Function cannot be reached through an ingress path that lets callers forge the header or bypass certificate enforcement.

This validator performs exact fingerprint matching; it does not build a certificate chain. Cloudflare certificate rotation therefore requires an updated fingerprint package. Validate(string) exposes the same comparison for callers that already have a hexadecimal SHA-256 fingerprint.

For request enforcement, Soenneker.Cloudflare.Middlewares.Require.Functions provides middleware built on this validator.

Product	Compatible and additional computed target framework versions.
.NET	net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed.

Compatible target framework(s)

Included target framework(s) (in package)

Learn more about Target Frameworks and .NET Standard.

net10.0
- Microsoft.Azure.Functions.Worker.Core (>= 2.52.0)
- Soenneker.Cloudflare.OriginCerts.Thumbprints (>= 4.0.39)
- Soenneker.Extensions.Spans.Readonly.Bytes (>= 4.0.63)
- Soenneker.Utils.File (>= 4.0.2241)
- Soenneker.Utils.Paths.Resources (>= 4.0.225)
- Soenneker.Validators.Validator (>= 4.0.737)

NuGet packages (1)

Showing the top 1 NuGet packages that depend on Soenneker.Cloudflare.Validators.Request.Functions:

Package	Downloads
Soenneker.Cloudflare.Middlewares.Require.Functions A middleware component for Azure Functions that enforces Cloudflare-only access, blocking non-Cloudflare requests unless running in local/test environments.	49.0K

GitHub repositories

This package is not used by any popular GitHub repositories.

Version	Downloads	Last Updated
4.0.351	0	9/1/2026
4.0.350	0	8/31/2026
4.0.349	0	8/31/2026
4.0.348	0	8/31/2026
4.0.347	0	8/31/2026
4.0.346	34	8/31/2026
4.0.345	37	8/31/2026
4.0.344	37	8/30/2026
4.0.343	63	8/30/2026
4.0.342	42	8/30/2026
4.0.341	55	8/29/2026
4.0.340	95	8/26/2026
4.0.339	85	8/26/2026
4.0.338	85	8/26/2026
4.0.337	138	8/22/2026
4.0.336	108	8/22/2026
4.0.335	103	8/22/2026
4.0.334	89	8/22/2026
4.0.333	87	8/22/2026
4.0.332	113	8/21/2026

Updated NuGet packages