Cloudflare probably shouldn’t be posting their tokens anywhere to anyone so it’s hard for me to think they’re some how in a moral high ground.
I think it's pretty fair for Cloudflare to place this in Okta's court. Okta customer support knew what they were asking for and should have had greater controls in place for dealing with those files safely.
> Okta explained that when it is troubleshooting issues with customers it will often ask for a recording of a Web browser session (a.k.a. an HTTP Archive or HAR file). These are sensitive files because in this case they include the customer’s cookies and session tokens, which intruders can then use to impersonate valid users. [2]
[0] Old content: http://web.archive.org/web/20230207011818/https://help.okta....
[1] New content with updated warning: https://help.okta.com/oag/en-us/content/topics/access-gatewa...
[2] https://krebsonsecurity.com/2023/10/hackers-stole-access-tok...
Sure, it’s still not a good idea for them to give Okta their tokens. But the above, combined with the fact that forgetting to redact a HAR is an incredibly easy mistake to make, makes me tend towards giving them a pass on this one.