I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL.
Now I always need an heroku addon to add my SSL certificates which costs $20/month.
Cloudflare enables SSL over DNS but I am a little bit curious. (So I don't need to get the heroku addon and can safe those $20/month)
What I think will happen looks like this
(user)-> [https]-> (cloudflare ssl)-> [http]-> (myserver)
Wouldn't this completely destroy the purpose of SSL?
I mean , can other user access the unecrypted http connection?
I spoke to cloudflare and they told me that the only way for unauthorized people to get the unencrypted data is to hack the cloudflare servers, so I am on the safe site.
Can anyone confirm this?