---
title: "Cloudflare WAF Auto"
description: "Solve a Cloudflare challenge and receive the protected response."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.uncaptcha.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare WAF Auto

Use task type `wafauto` when uncaptcha.io should make the solved follow-up
request and return its response.

## Request data

The input is the same as a regular [Cloudflare WAF task](/tasks/cloudflare-waf).

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `url` | string | Yes | Challenged URL to fetch |
| `proxy` | string | Yes | Sticky proxy for solving and fetching |
| `user_agent` | string | No | User-Agent to preserve |
| `html` | string | No | Challenge response HTML |

When omitted, `user_agent` defaults to:

```text
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
```

Almost all User-Agents are supported, including Safari, Chrome, and Firefox on
Windows, macOS, Linux, Android, and iOS.

```json
{
  "task_type": "wafauto",
  "task_data": {
"url": "https://example.com/protected",
"proxy": "http://user:pass@203.0.113.10:8080",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ..."
  }
}
```

> **Do not mix client identities**
>
> If you provide challenge HTML, it must come from the same proxy, User-Agent,
> Client Hints, and browser or TLS identity sent with the task. A
> `waf solver failure` response usually means one of these values does not
> match, the proxy session changed, or the supplied HTML came from a different
> client identity.

## Solution

```json title="data.solution"
{
  "clearance": "abc123...",
  "cf_bm": "xyz789...",
  "headers": {
"user-agent": "Mozilla/5.0 ...",
"sec-ch-ua": "\"Chromium\";v=\"143\""
  },
  "response": {
"url": "https://example.com/protected",
"status_code": 200,
"headers": {
  "content-type": "text/html; charset=utf-8"
},
"base64_body": "PCFET0NUWVBFIGh0bWw+..."
  }
}
```

| Field | Type | Description |
| --- | --- | --- |
| `clearance` | string | Value for the `cf_clearance` cookie |
| `cf_bm` | string or null | Optional `__cf_bm` cookie value |
| `headers` | object | Browser headers used for the solved request |
| `response.url` | string | Final URL after redirects |
| `response.status_code` | integer | Final HTTP status |
| `response.headers` | object | Response headers |
| `response.base64_body` | string | Base64-encoded response bytes |

## Decode the body

### Python

```python
import base64

body = base64.b64decode(solution["response"]["base64_body"])
```
### Node.js

```javascript
const body = Buffer.from(solution.response.base64_body, "base64");
```
### Go

```go
body, err := base64.StdEncoding.DecodeString(solution.Response.Base64Body)
```

> **Tip**
>
> Prefer WAF Auto when you only need the protected response. Use regular WAF
> when you need to continue a longer stateful browser or HTTP session yourself.

Source: https://docs.uncaptcha.io/tasks/waf-auto/index.mdx