--- title: "Cloudflare WAF" description: "Solve a Cloudflare challenge and continue through your own HTTP client." --- > Documentation Index > Fetch the complete documentation index at: https://docs.uncaptcha.io/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare WAF Use task type `waf` when your application will perform the request after the challenge has been solved. ## Request data | Field | Type | Required | Description | | --- | --- | --- | --- | | `url` | string | Yes | URL that returned the Cloudflare challenge | | `proxy` | string | Yes | Sticky proxy used for the original and follow-up requests | | `user_agent` | string | No | User-Agent from the challenged client | | `html` | string | No | Challenge response HTML | When omitted, `user_agent` defaults to: ```text Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 ``` Almost all User-Agents are supported, including Safari, Chrome, and Firefox on Windows, macOS, Linux, Android, and iOS. ```json title="task_data" { "url": "https://example.com/protected", "proxy": "http://user:pass@203.0.113.10:8080", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...", "html": "..." } ``` > **Do not mix client identities** > > Changing the proxy, User-Agent, Client Hints, or TLS fingerprint can > invalidate the clearance. If you provide challenge HTML, its originating > request must match the identity you send here. A `waf solver failure` > response usually means one of these values does not match, the proxy session > changed, or the supplied HTML did not come from the same client identity. ## Solution | Field | Type | Description | | --- | --- | --- | | `clearance` | string | Value for the `cf_clearance` cookie | | `cf_bm` | string or null | Optional value for the `__cf_bm` cookie | | `cf_rt` | string or null | Optional first-request `__cf_chl_tk` query value | | `headers` | object | Browser headers used during the solve | | `attributes` | object | Form fields for the first follow-up POST | ```json title="data.solution" { "clearance": "abc123...", "cf_bm": "xyz789...", "cf_rt": "token123...", "headers": { "user-agent": "Mozilla/5.0 ...", "sec-ch-ua": "\"Chromium\";v=\"143\"", "sec-ch-ua-mobile": "?0", "sec-ch-ua-platform": "\"Windows\"" }, "attributes": { "a": "value1", "b": "value2" } } ``` ## Apply the solution 1. **Reuse the same proxy** Make the follow-up request through the exact proxy used for the solve. 2. **Set the cookies and headers** Set `cf_clearance` and, when present, `__cf_bm`. Reuse the returned headers exactly, especially `user-agent` and Client Hints. 3. **Build the first request** Make a `POST` request to the original challenged URL. Set `Referer` to that same URL; when `cf_rt` is present, add it to the `Referer` query string as `__cf_chl_tk` while preserving any existing query parameters. Send `attributes` as the form body using `application/x-www-form-urlencoded`. Python `wreq` performs the encoding when you pass `form=solution.get("attributes", {})`. Source: https://docs.uncaptcha.io/tasks/cloudflare-waf/index.mdx