I'm not sure where to post this, so I figured I'd just post it here.
CloudFlare is now offering free SSL to all sites. There are two different types of SSL connections, however. There's "Flexible SSL" which runs HTTPS on the Client <=> CloudFlare connection, but regular HTTP on the CloudFlare <=> Server connection. While this is certainly better than nothing, it's misleading to the user who thinks that his or her data is entirely encrypted for as long as it's on the wire.
There's also "Full SSL" which is secure for the entire User <=> CloudFlare <=> Server connection.
Therefore, I propose a new HTTP header named something like
X-Proxy-Security which could indicate to the user-agent how the proxy is handling secure connections. Its value could be something like
end-to-end for full end-to-end encryption or
client-to-proxy for connections that are only secure between the client and the proxy. The header ideally shouldn't contain any specific CloudFlare references since there are plenty of HTTP proxies like CDNs and services similar to CloudFlare.
If it were implemented, browsers wouldn't know how to handle it at first so nothing would change. However, browser extensions could be developed to relay the status to the user. Browsers could eventually implement some form of indicator similar to how they indicate mixed content or whatever currently.
Would this work? How would we push to implement it?