0

I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish the origin from the CDN? I always see the HTTP header Server: CloudFlare even if the response came from the origin. Why don't I see Server: Nginx?

Improve this question
6
  • I edited your question to change "firewall" to "CDN", because that's what CloudFlare is. Please look up what CloudFlare actually does. They have several diagrams on their site to explain. CloudFlare is the server.
    – schroeder ♦
    Dec 23, 2020 at 14:59
  • Alright. Thank you for editing. I will take a look at it
    – Bahamas
    Dec 23, 2020 at 15:01
  • @schroeder, A minor and respectful disagreement with you on this. Cloudflare offers multiple services. Among them is a Content Delivery Network (CDN) service (advertised at cloudflare.com/cdn), and another among them is a Web Application Firewall (WAF) service (advertised at cloudflare.com/waf). I believe the OP's question is in regard to Cloudflare's WAF service. Just my $0.02.
    – mti2935
    Dec 23, 2020 at 15:07
  • @mti2935 yep - I am aware. But if the response says Server: CloudFlare ...
    – schroeder ♦
    Dec 23, 2020 at 15:23
  • @schroeder Yes, Server: CloudFlare is normally seen in the response headers for sites protected by Cloudflare's WAF.
    – mti2935
    Dec 23, 2020 at 15:35

1 Answer 1

Reset to default
0

I'm not sure how you're accessing the origin directly unless you're accessing the origin by using its IP. Once you point your domain name at Cloudflare, all requests go through Cloudflare.

Assuming you're accessing the domain name, the content itself did come from your origin even if Cloudflare is currently returning a cached response. You can see if it's a cached response based 'cf-cache-status' header (hit = Cloudflare cache, miss = Cloudflare had to make a request to your origin because it didn't have anything in cache).

You can also turn on Development Mode so Cloudflare bypasses cache.

Temporarily bypass our cache. See changes to your origin server in realtime.

Cheers.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .