Cloudflare Access 新增严格 Service Token 认证
Access, Cloudflare One - New strict service token authentication setting for Access
依赖 Cloudflare Access 集成服务账号的开发者必须关注此变更。新组织默认开启且不可关闭，旧组织建议尽快在生效前完成迁移，否则可能因鉴权行为改变导致自动化流程中断。
The strict service token authentication setting applies consistent behavior to requests made with service tokens. When the setting is on for a Zero Trust organization, Access handles requests with service token headers as follows:
严格的 Service Token 身份验证设置对使用 Service Token 发出的请求应用一致的行为。当 Zero Trust 组织启用此设置时，Access 按以下方式处理带有 Service Token 头的请求：
- If authentication or authorization fails, Access always returns 401 or 403 instead of redirecting the client to the login page with 302.
- Only Service Auth policies can authorize the request. Access ignores Allow policies and any CF_Authorization cookie sent with the request.
- Access does not return a CF_Authorization cookie to the client after successful authentication. Subsequent requests should continue to use service token headers.
- Failed requests for recognized service tokens appear in Access authentication logs.
- 如果身份验证或授权失败，Access 始终返回 401 或 403，而不是使用 302 将客户端重定向到登录页面。
- 只有 Service Auth 策略才能授权该请求。Access 会忽略 Allow 策略以及随请求发送的任何 CF_Authorization cookie。
- 成功身份验证后，Access 不会向客户端返回 CF_Authorization cookie。后续请求应继续使用 Service Token 头。
- 已识别的 Service Token 的请求失败情况会显示在 Access 身份验证日志中。
Zero Trust organizations created on or after October 5, 2026 have strict service token authentication turned on by default and cannot turn it off. Cloudflare recommends that existing organizations turn it on as well.
2026 年 10 月 5 日或之后创建的 Zero Trust 组织默认启用严格的 Service Token 身份验证，且无法关闭。Cloudflare 建议现有组织也启用此功能。
Organizations created before October 5, 2026 can configure the setting in the dashboard or through the API.
2026 年 10 月 5 日之前创建的组织可以在仪表板或通过 API 配置此设置。
- In the Cloudflare dashboard ↗︎, go to Zero Trust > Access controls > Access settings.
- Go to Access settings ↗
- Under Manage service tokens, turn on Strict service token authentication.
- In the confirmation dialog, select Enable.
- 在 Cloudflare 仪表板 ↗︎ 中，转到 Zero Trust > Access controls > Access settings。
- 转到 Access settings ↗
- 在 Manage service tokens 下，开启 Strict service token authentication。
- 在确认对话框中，选择 Enable。
To turn off strict service token authentication, turn off the setting and select Disable.
要关闭严格的 Service Token 身份验证，请关闭该设置并选择 Disable。
curl "https://api.cloudflare.com/client/v4/accounts/%7Baccount_id%7D/access/organizations" \
--request PATCH \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--json '{
"strict_service_token_auth": true
}'To turn off strict service token authentication, set strict_service_token_auth to false.
要关闭严格的 Service Token 身份验证，请将 strict_service_token_auth 设置为 false。
For behavior and configuration details, refer to Strict service token authentication.
有关行为和配置的详细信息，请参阅 Strict service token authentication。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力