# Cloudflare WAF blocking custom SQL

**URL:** <https://community.forestadmin.com/t/cloudflare-waf-blocking-custom-sql/3697>\
**Category:** Help me!\
**Created:** [November 10, 2021, 2:37pm UTC](https://community.forestadmin.com/t/cloudflare-waf-blocking-custom-sql/3697 "2021-11-10T14:37:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JoshBridgement](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/joshbridgement/32/3513_2.png) [@JoshBridgement](https://community.forestadmin.com/u/JoshBridgement)\
**Post date:** [November 10, 2021, 2:37pm UTC](https://community.forestadmin.com/t/cloudflare-waf-blocking-custom-sql/3697/1 "2021-11-10T14:37:35Z")

</div>

## Expected behavior

Charts that use a Custom SQL data source should not trigger basic generic security layers such as Cloudflare WAF. Sending the raw SQL as the payload seems to have this effect

## Actual behavior

Cloudflare WAF and similar services (including Sqreen) will automatically block the request with a HTTP 403

## Context

We imagine Custom SQL is a popular feature and considering how widespread security tools like cloudflare are, we were wondering if there is a recommended approach to this problem

---

<div class="post-metadata">

**Author:** ![anon39848301](https://avatars.discourse-cdn.com/v4/letter/a/b9e5f3/32.png) [@anon39848301](https://community.forestadmin.com/u/anon39848301)\
**Post date:** [November 10, 2021, 2:46pm UTC](https://community.forestadmin.com/t/cloudflare-waf-blocking-custom-sql/3697/2 "2021-11-10T14:46:57Z")

</div>

Hey @JoshBridgement 👋

Indeed, we have a few issues with Cloudflare WAF services.  
If you have on hand the list of WAF rules triggered, may I ask you to share these here or as DM?  
(That is useful for us, since Custom SQL aren’t the only source of issues we encounter with Cloudflare)

Sadly, the only workaround we’ve found so far is to either disable the WAF services on specific routes or on the whole `/forest` namespace.

---

<div class="post-metadata">

**Author:** ![JoshBridgement](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/joshbridgement/32/3513_2.png) [@JoshBridgement](https://community.forestadmin.com/u/JoshBridgement)\
**Post date:** [November 10, 2021, 2:50pm UTC](https://community.forestadmin.com/t/cloudflare-waf-blocking-custom-sql/3697/3 "2021-11-10T14:50:40Z")

</div>

Thanks - I have sent you a list of the affected WAF services