Soenneker.Cloudflare.Validators.Request 4.0.351

Prefix Reserved
.NET 10.0 This package targets .NET 10.0. The package is compatible with this framework or higher. 
dotnet add package Soenneker.Cloudflare.Validators.Request --version 4.0.351
                    


                    

                
NuGet\Install-Package Soenneker.Cloudflare.Validators.Request -Version 4.0.351
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="Soenneker.Cloudflare.Validators.Request" Version="4.0.351" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="Soenneker.Cloudflare.Validators.Request" Version="4.0.351" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="Soenneker.Cloudflare.Validators.Request" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add Soenneker.Cloudflare.Validators.Request --version 4.0.351
                    


                    

                
#r "nuget: Soenneker.Cloudflare.Validators.Request, 4.0.351"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package Soenneker.Cloudflare.Validators.Request@4.0.351
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=Soenneker.Cloudflare.Validators.Request&version=4.0.351
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=Soenneker.Cloudflare.Validators.Request&version=4.0.351
                    


                            Install as a Cake Tool

alternate text is missing from this package README image alternate text is missing from this package README image alternate text is missing from this package README image alternate text is missing from this package README image

Soenneker.Cloudflare.Validators.Request

Validates an ASP.NET Core request's TLS client certificate against Cloudflare's Authenticated Origin Pull CA.

Installation

dotnet add package Soenneker.Cloudflare.Validators.Request

Registration

using Soenneker.Cloudflare.Validators.Request.Registrars;

services.AddCloudflareRequestValidatorAsSingleton();

The package supplies the Cloudflare Authenticated Origin Pull CA certificate as a build resource. Set Cloudflare:RequestValidatorLog to true only when debug logging for missing or invalid certificates is useful.

Usage

using Soenneker.Cloudflare.Validators.Request.Abstract;

bool fromCloudflare = await validator.IsFromCloudflare(
    httpContext,
    httpContext.RequestAborted);

if (!fromCloudflare)
{
    httpContext.Response.StatusCode = StatusCodes.Status403Forbidden;
    return;
}

IsFromCloudflare requires a client certificate on HttpContext.Connection.ClientCertificate. It builds a custom-trust chain to the packaged Cloudflare CA, requires the client-authentication extended key usage, disables certificate downloads, and performs normal certificate validity checks.

Required origin setup

This validator is meaningful only when all of the following are true:

  • Authenticated Origin Pulls is enabled for the Cloudflare zone.
  • The public origin accepts traffic only through Cloudflare or otherwise requires a valid client certificate.
  • The TLS endpoint serving ASP.NET Core requests requests and forwards the actual client certificate.

If TLS terminates at a load balancer or reverse proxy, configure certificate forwarding only across a trusted internal boundary. A public request header is not proof of a client certificate and must not be copied into ClientCertificate without authenticating the proxy that supplied it.

Validate(string) is a lower-level fingerprint comparison. It compares the supplied hexadecimal SHA-256 value with the packaged CA certificate; it does not validate a request or leaf certificate chain.

This package verifies Cloudflare's shared Authenticated Origin Pull CA, not a zone-specific origin-pull certificate. For enforcement in MVC applications, Soenneker.Cloudflare.Attributes.Require provides an authorization filter built on this validator.

Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (1)

Showing the top 1 NuGet packages that depend on Soenneker.Cloudflare.Validators.Request:

Package Downloads
Soenneker.Cloudflare.Attributes.Require

A .NET authorization filter for requiring Cloudflare sourced traffic

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
4.0.351 0 8/31/2026
4.0.350 0 8/31/2026
4.0.349 19 8/30/2026
4.0.348 52 8/30/2026
4.0.347 63 8/30/2026
4.0.346 96 8/26/2026
4.0.345 54 8/26/2026
4.0.344 50 8/26/2026
4.0.343 145 8/22/2026
4.0.342 108 8/22/2026
4.0.341 104 8/22/2026
4.0.340 96 8/22/2026
4.0.339 178 8/19/2026
4.0.338 114 8/19/2026
4.0.337 115 8/18/2026
4.0.336 206 8/12/2026
4.0.335 93 8/12/2026
4.0.334 112 8/12/2026
4.0.333 94 8/12/2026
4.0.332 89 8/12/2026
Loading failed

Update dependency Soenneker.Cloudflare.OriginCerts.Thumbprints to 4.0.39 (#607)