0

Suppose a website is set up so that only IPs from country X are allowed read/write access. This server goes through a CDN such as Cloudflare.

Because the GeoIP read block is at server level, it never actually works because Cloudflare will always cache from an IP in country X and broadcast worldwide so anyone outside of country X will still be able to read the version that was cached by Cloudflare locally.

What vulnerabilities remain open with this setup on the write side?

  • Any that are open? An IP address block by country doesn't mitigate vulnerabilities at all. It only (slightly) limits access – Conor Mancone Aug 4 at 1:58
  • Oh yeah, I meant specific to the interaction with the CDN. In other words, is the CDN cache read only or are there built-in tunnels for write side that could be a threat? – cvlo Aug 4 at 3:15
1

Cloudflare is essentially a reverse proxy which might also cache content. If the content is then actually served from the cache or if the request is passed through the origin server can be influenced by the server itself through the use of standard Cache-Control HTTP headers. Thus, if the server wants to control access to specific content but still allow other content to be cached just set Cache-Control appropriately.

Additionally the original client IP address can be passed through the server as a special HTTP header so that any geo-blocking can be done.

What vulnerabilities remain open with this setup on the write side?

When properly setup using above mechanisms only the usual risk of a CDN apply, in that the CDN can in theory read and modify any content in transit, even if https:// is in use.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.