We run our apps on Heroku and use Cloudflare as a CDN and to protect against DOS attacks. However, we recently experienced (a relatively minor) attack that managed to easily bypass Cloudflare by simply sending requests to one of the routing servers that Heroku hosts on AWS while setting the requests' Host: header to our site's hostname. This worked because Heroku's internal application routing is entirely based on that header.

I asked Heroku if they could do anything about this and they suggested handling it at the middleware layer (which we are, using nginx rules). But this still allows the attacking traffic to hit our dyno and while this attack was managed using that strategy I would think that a larger attack would slow down nginx, even if the server was 403ing the connections en masse.

Short of us running our own reverse proxy, does anyone have a suggestion for a better strategy? Isn't it a major weakness of Heroku's architecture that they route to apps based on the Host: request header rather than assigning IP addresses to dynos? Is that typical for PaaS?

  • No do not use cloudfront/cloudflare. Especially mixed together oh god you're asking to be ddosed.
    – user121987
    Commented Aug 21, 2016 at 1:43

2 Answers 2


There are 2 ways to solve your problem:

  1. Put an AWS Cloudfront distribution between Cloudflare and Heroku. You can use them together and Cloudfront is suitable for dynamic content.
  2. Override the Host header in Cloudflare. As of early 2016 it requires an Enterprise subscription.

In both cases, you remove the front-facing domain from Heroku control panel, effectively preventing direct requests from hitting your dyno.

P.S. Just to be clear, you set the Host header (origin for Cloudfront) in both cases to something like evening-sands-32400.herokuapp.com.


I would look at Akamai which also has a CDN based DDoS prevention system. However they also have a web application firewall (WAF) which can do some pretty sophisticated filtering based on request headers or any other data in the HTTP/HTTPS sessions.

Even if you don't use Akamai per se, I think a WAF should be considered.

  • @user132547, thanks for the suggestion — I'll check out WAFs. But I still don't see how this could be used to protect our Heroku dynos.
    – sumizome
    Commented Sep 10, 2015 at 14:52
  • Could you draw a diagram of all this? Commented Sep 10, 2015 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .