Unecrypted connection to server - safe?

Question

I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL.

Now I always need an heroku addon to add my SSL certificates which costs $20/month.

Cloudflare enables SSL over DNS but I am a little bit curious. (So I don't need to get the heroku addon and can safe those $20/month)

What I think will happen looks like this

(user)-> [https]-> (cloudflare ssl)-> [http]-> (myserver)

Wouldn't this completely destroy the purpose of SSL?

I mean , can other user access the unecrypted http connection?

Update1:

I spoke to cloudflare and they told me that the only way for unauthorized people to get the unencrypted data is to hack the cloudflare servers, so I am on the safe site.

Can anyone confirm this?

Answer 1

It doesn't completely destroy the purpose of SSL. It certainly does offer some significant benefits, but it also has some limitations as well, as you've correctly identified.

The benefits: it prevents eavesdropping of data from near the user. For instance, if the user is connecting over open Wifi, SSL encryption to Cloudflare would help.

The limitations: As you and others have correctly identified, the data is sent in cleartext between Cloudflare's servers and your servers. Therefore, it is open to attacks during that point of time. Also, a security breach of Cloudflare's servers could expose your data. In addition, depending upon how Cloudflare does it, it may be hard for users to verify the validity of the SSL cert that is served up with your domain (you might want to check whether users have to click through cert warnings, and what domain is showing in the address bar).

Bottom line: SSL through Cloudflare is better than nothing, but not as good as end-to-end encryption that terminates at your Heroku application. Whether it is good enough for your purposes depends upon risk management decisions, like how security critical your application is and how much security you need.

Answer 2

It is not like CloudFlare has not been hacked before. See this. Also, since SSL is getting terminated at CloudFlare this means that data is going in plaintext from CloudFlare to Heroku. So anyone in the path to Heroku from CloudFlare can "see" data.