Free Session Validator for Cloudflare 1.0.0

Validates XenForo sessions and adds verification headers for Cloudflare WAF rules to distinguish bet​

• Automatic Session Validation - Validates XenForo sessions early in the request cycle before any content is processed
• Security Headers - Adds custom HTTP headers that Cloudflare can read to identify verified users
• Flexible Configuration - Control what information is exposed via headers with verbose output options
• Lightweight Performance - Minimal impact with efficient database queries and optional caching
• Privacy Conscious - Verbose output can be disabled to limit exposed information
• Bot Protection - Easily create WAF rules to block malicious bots while allowing legitimate users

1. Session cookies (xf_session, xf_user, xf_csrf)
2. Session activity in the database
3. User authentication status

You must log in to view
(3 lines)

• Block Aggressive Bots - Create rules that challenge or block requests without valid sessions
• Protect Against DDoS - Rate limit non-authenticated users more aggressively
• Prevent Content Scraping - Require valid sessions for accessing certain content
• Enhanced Security Rules - Build complex WAF rules based on user authentication status
• Member-Only Areas - Enforce authentication at the edge with Cloudflare

You must log in to view
(1 lines)

• Enable/Disable - Turn session validation on/off
• Activity Window - Set how long users are considered active (default: 24 hours)
• Verbose Output - Include additional headers with user details (ID, username, staff status)

• Integrates via XenForo event listeners (app_setup, app_admin_setup, app_api_setup)
• Validates against xf_session_activity table
• Supports both regular and admin sessions
• Compatible with XenForo's built-in caching systems
• Clean uninstall with no database modifications

• XenForo 2.2.0 or higher
• PHP 7.2 or higher
• Cloudflare account (Free, Pro, Business, or Enterprise)
• Basic knowledge of Cloudflare WAF rules

1. Download and extract the add-on
2. Upload to src/addons/WindowsForum/SessionValidator/
3. Install via Admin CP → Add-ons
4. Configure options in Admin CP → Options → Session Validator
5. Create Cloudflare WAF rules using the provided headers

• Initial release
• Core session validation functionality
• Configurable verbose output
• Full documentation included