Live
OpenShift 5 observability adds autonomous troubleshooting with LightspeedPartitioned __cf_bm cookie enables Bot Management continuity in third‑party iframesAI Production Architecture: Lessons from Microsoft Ignite’s Frontier TransformationBorderless Lakehouse Redefines Data Access for AI AgentsDynamic Model Switching in Gemini 4 Cuts Coding Agent Latency and Token CostRunning SGLang‑Neuron on AWS Trainium: Architecture and Ops GuideTerraform v5.29.0 adds full namespace control for Cloudflare AI SearchBeyond Token Pricing: Managing Amazon Bedrock Cost per TaskOpenShift 5 observability adds autonomous troubleshooting with LightspeedPartitioned __cf_bm cookie enables Bot Management continuity in third‑party iframesAI Production Architecture: Lessons from Microsoft Ignite’s Frontier TransformationBorderless Lakehouse Redefines Data Access for AI AgentsDynamic Model Switching in Gemini 4 Cuts Coding Agent Latency and Token CostRunning SGLang‑Neuron on AWS Trainium: Architecture and Ops GuideTerraform v5.29.0 adds full namespace control for Cloudflare AI SearchBeyond Token Pricing: Managing Amazon Bedrock Cost per Task
Cloudflare

Partitioned __cf_bm cookie enables Bot Management continuity in third‑party iframes

Ninja·November 13, 2026·2 min read·via Cloudflare Application Security
AI SummaryPowered by AI

Cloudflare now adds the Partitioned attribute to the cfbm cookie on HTTPS requests that also use SameSite=None and Secure. This lets Bot Management persist when content is embedded in an iframe, preserving mitigation state despite third‑party cookie blocks.

Cloudflare now attaches the Partitioned attribute to the __cf_bm cookie on HTTPS requests that are also eligible for SameSite=None and Secure. The attribute is only added when those conditions are met.

What Changed

The __cf_bm cookie, used by Cloudflare Bot Management, can now be marked as Partitioned. When a browser receives this attribute, the cookie is scoped to the top‑level site that initiated the request, even if the request originates from a third‑party context such as an <iframe>.

Why It Matters for Engineers

Embedding Cloudflare‑protected content inside an iframe causes browsers to treat __cf_bm as a third‑party cookie. Many privacy settings block third‑party cookies, which breaks the continuity of Bot Management checks across requests. With the Partitioned flag, the cookie survives within the embedding site, allowing Bot Management to maintain its state without requiring users to relax third‑party cookie blocking.

Operational and Security Considerations

  • Ensure that the origin serves the cookie over HTTPS and includes SameSite=None and Secure, otherwise the Partitioned attribute will not be applied.
  • Validate that target browsers support the Partitioned attribute; older browsers will ignore it and fall back to standard third‑party handling.
  • Monitor cookie logs to confirm that the attribute is present when expected, especially after changes to TLS termination or CDN configuration.
  • Recognize that the attribute limits the cookie to the top‑level site, reducing cross‑site tracking risk while still enabling Bot Management functionality.

Related CloudNinjas coverage: security.

What This Means For Practitioners

Review any services that rely on __cf_bm and are delivered via iframes. Verify that your TLS and cookie settings meet the SameSite=None + Secure criteria so the Partitioned flag can be applied. Test embedded flows in browsers with strict third‑party cookie policies to confirm Bot Management continuity. Keep an eye on browser release notes for support updates or deprecations related to the Partitioned attribute.

Tags: #bots#cookies#cloudflare#partitioned
Originally published atCloudflare Application Security
Related Articles
Cloudflare

Metric‑Driven Views for Web Assets Operations Simplify Prioritization

2 min read
GitHub

Direct URLs for GitHub public monitoring alerts streamline triage and sharing

2 min read
GitHub

GitHub secret scanning adds Cloudflare service token detection

2 min read