securing with waf causes problems

[Markus-Sup]

Hi,

iam trying to secure the cal environment so that the admin panel is not reachable from outside.

When activating this WAF rule (using cloudflare), the booking page is not blocked, but the content is not displayed (just a blank white page) so its not a WAF issue (while cal.mydomain.com gets blocked with a correct message).

But i can see the URL behaviour/end URL is different

instead of
/booking/termin?user=booking&date=2024-11-29&month=2024-11

its loading
/booking/termin?user=booking&__cpo=aHR0cHM6Ly9jYWwuZ3Jvd2NvZGlsZS5jb20

I also tried to exclude the URI path for /API

Could you tell me what I additionally need to unblock to make it work?

Thank you very much