Thanks for flagging this one. This sounds like a rules issue, but we'll take a look and confirm. Also, are you using cloudflared access or warp on the client side? Do you have a screenshot you'd be able to share of redacted logs as well?

Thank you! It was cloudflared access rdp.

The client failed with failed to connect to origin error="websocket: bad handshake".

This is the firewall event:

{
  "action": "managed_challenge",
  "clientASNDescription": "REDACTED",
  "clientAsn": "REDACTED",
  "clientCountryName": "US",
  "clientIP": "REDACTED",
  "clientRequestHTTPHost": "REDACTED",
  "clientRequestHTTPMethodName": "GET",
  "clientRequestHTTPProtocol": "HTTP/1.1",
  "clientRequestPath": "/",
  "clientRequestQuery": "",
  "datetime": "REDACTED",
  "rayName": "REDACTED",
  "ruleId": "874a3e315c344b1281ad4f00046aab6f",
  "rulesetId": "48ba18287c544bd7bdbe842a294f1ae2",
  "source": "firewallManaged",
  "userAgent": "Go-http-client/1.1",
  "matchIndex": 0,
  "metadata": [
    {
      "key": "ruleset_version",
      "value": "4"
    },
    {
      "key": "version",
      "value": "3"
    },
    {
      "key": "type",
      "value": "customer"
    }
  ],
  "sampleInterval": 1
}

I was able to connect to the CloudFlare access domain from within the browser and access the 200 OK page. I suppose the Go-http-client agent classifies this request as automated, which is fair enough.

We are seeing things like git/Gitea be blocked:

git/2.30.1 (Apple Git-130) (Darwin Kernel Version 21.2.0: Sun Nov 28 20:28:54 PST 2021; root:xnu-8019.61.5~1/RELEASE_X86_64 21.2.0; darwin x64) vscode/1.63.2 (Visual Studio Code)

Query string: ?service=git-upload-pack
Service: Bot fight mode
Action taken: JS Challenge

Looks like Jenkins build jobs are also being blocked:

Query string: ?delay=0sec
Service: Bot fight mode
Action taken: JS Challenge