Forget IPs: using cryptography to verify bot and agent traffic

a year ago

Cloudflare introduces two proposals for bot authentication: HTTP message signatures and request mTLS.
Existing bot verification mechanisms like user agent headers and IP addresses are unreliable and easily spoofed.
HTTP Message Signatures provide a cryptographic way for bots to authenticate themselves, improving security and reliability.
Request mTLS uses mutual TLS certificates for authentication, with a new TLS flag to signal support.
Both methods aim to give site owners better control over automated traffic and improve transparency.
Cloudflare is working with industry partners like OpenAI to standardize these authentication mechanisms.
Examples and code for implementing these solutions are available on GitHub.
The proposals are part of Cloudflare's broader effort to enhance bot management and AI audit capabilities.

Hasty Briefsbeta