# Support Cloudflare Zero Trust Service Tokens in the CLI Scanner

**URL:** <https://community.sonarsource.com/t/support-cloudflare-zero-trust-service-tokens-in-the-cli-scanner/59523>\
**Category:** Suggest new features\
**Tags:** authentication, sonarqube\
**Created:** [March 8, 2022, 5:31am UTC](https://community.sonarsource.com/t/support-cloudflare-zero-trust-service-tokens-in-the-cli-scanner/59523 "2022-03-08T05:31:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ken\_Lewerentz](https://avatars.discourse-cdn.com/v4/letter/k/71c47a/32.png) [@Ken\_Lewerentz](https://community.sonarsource.com/u/Ken_Lewerentz)\
**Post date:** [March 8, 2022, 5:31am UTC](https://community.sonarsource.com/t/support-cloudflare-zero-trust-service-tokens-in-the-cli-scanner/59523/1 "2022-03-08T05:31:17Z")

</div>

We are looking at running SonarQube behind CloudFlare Zero Trust and providing the [Zero Trust Service Tokens](https://developers.cloudflare.com/cloudflare-one/identity/service-auth/service-tokens/) HTTP headers as parameters to the Sonar Scanner.

The idea would be to allow a GitHub Action that is using `sonarsource/sonarqube-scan-action` or a developer running the scanner manually to securely connect to SonarQube.

It seems this could be achieved by:

- Providing custom headers as props, passed on command line
- Retrieving the headers in the [Sonar Scanner API ServerConnection::create ServerConnection.java](https://github.com/SonarSource/sonar-scanner-api/blob/d989a2d2d7525d495a34df2bbeb426f865d622e4/api/src/main/java/org/sonarsource/scanner/api/internal/ServerConnection.java#L59)
- Adding the headers to the [Sonar Scanner API ServerConnection::ResponseBody (ServerConnection.java)](https://github.com/SonarSource/sonar-scanner-api/blob/master/api/src/main/java/org/sonarsource/scanner/api/internal/ServerConnection.java#L112)

Does this look like a possible solution?

---

<div class="post-metadata">

**Author:** ![emex](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/emex/32/6321_2.png) [@emex](https://community.sonarsource.com/u/emex)\
**Post date:** [March 30, 2023, 6:45pm UTC](https://community.sonarsource.com/t/support-cloudflare-zero-trust-service-tokens-in-the-cli-scanner/59523/2 "2023-03-30T18:45:03Z")

</div>

FYI i opened a similar request, without knowing about yours

> [@Secure Sonarqube instance with Cloudflare Access](https://community.sonarsource.com/t/secure-sonarqube-instance-with-cloudflare-access/88234/4):
>
> Thanks Colin, this is definitely interesting. The ticket raised by Ken is completely aligned with my need. SONAR\_SCANNER\_OPTS could indeed be an option to pass the required parameters but the ones related to http proxy that you shared won’t cover our need (http proxy is used to provide access to internet from private network). Such parameter could work though: SONAR\_SCANNER\_OPTS=“-Dhttp.extraHeader=CF-Access-Client-Id: -Dhttp.extraHeader=CF-Access-Client-Secret:” This would be quite straight…

---

<div class="post-metadata">

**Author:** ![Ken\_Lewerentz](https://avatars.discourse-cdn.com/v4/letter/k/71c47a/32.png) [@Ken\_Lewerentz](https://community.sonarsource.com/u/Ken_Lewerentz)\
**Post date:** [December 13, 2023, 10:10am UTC](https://community.sonarsource.com/t/support-cloudflare-zero-trust-service-tokens-in-the-cli-scanner/59523/3 "2023-12-13T10:10:50Z")

</div>

Thanks for providing the link to your request Maxime.