@kian I saw a message from you about it. Do you have maybe the time to help or give me a hint whats wrong here?

When i access teamname.cloudflareaccess.com/cdn-cgi/trace i get gateway=on warp=on So its not the split tunnel

i also tried the jwt from the cf-access-jwt-assertion and cookie headers but neither worked

You need to use the

identity_nonce

part of the JWT payload when making the request

@Cyb3r-Jok3 i just decoded the JWT payload and i dont have the identity_nonce field on it.

{
  "type": "app",
  "aud": "*****************",
  "exp": 1705126723,
  "iss": "https://teamname.cloudflareaccess.com",
  "iat": 1705040323,
  "sub": ""
}

ok after some testing: It works with applications where i have a allow/block policy. It doesnt work with Service Auth Policies.

is there anything i have to change to get it working with service auth?

tbh. i just need the email. And i cant use an Allow rule instead of the service auth because its an rest api which is portected with it

At least

So currently im using gateway and service auth to allow access to my rest api

Is there an alternative way?

Which gives me the jwt with identity?

When i change it to allow i need to login and get redirected to the login page when i want to access my api

thank you so much

like this

with this configuration i completely skip the authentication when im using gateway which is essential to access the rest api

otherwise i get a 302 moved -> login page of access

Here a summary: I have 2 services: api.example.com -> Worker/Hono REST API app.example.com -> Website on Cloudflare Pages I want to add a security/login layer from cloudflare. I want something like zero trust to stay between these 2 services and the end user and handle authentication. For the App i also need need the E-Mail address of the current user to send emails or something. Just to know whos who. So i tried Cloudflare Zero trust. I created an Application and added the 2 Domains of the services into the Access Application. At the beginning I first created a normal Allow Policy for Access Group X. The problem with that is, that I always get redirected to the Login Page and therefor cant access the rest API in my app and get errors because of the non existing Authorization Headers. Then I tried a policy with the Action "Service Auth" and set as required "Gateway". Now I have the app protected by zero trust with the requirement to have gateway enabled which is perfect beause the user just need to activate the gateway app and connects to access the application/worker. But now I still need the E-Mail of the user. So i checked the JWT in the Header. Didnt contain any identity data because its an service auth. Also the get-identity endpoint didnt help. When i use a Allow Policy i have the identity of the user in the JWT. Now I need a new Idea how to protect the app without the problem of the nonexistence of the identity header or the redirect error because cloudflare routes my fetch request to the login page in the app. So my 2 outgoings are: A: Allow Policy with identity info but cant access the rest api in my app because im not logged in with the "fetch" client B: Service Auth Policy which lets me access the API only in gateway (good) but without identity info

@Cyb3r-Jok3 sorry for the spam i just want to give as many details as possible