We run our apps on Heroku and use Cloudflare as a CDN and to protect against DOS attacks. However, we recently experienced (a relatively minor) attack that managed to easily bypass Cloudflare by simply sending requests to one of the routing servers that Heroku hosts on AWS while setting the requests' Host: header to our site's hostname. This worked because Heroku's internal application routing is entirely based on that header.
I asked Heroku if they could do anything about this and they suggested handling it at the middleware layer (which we are, using nginx rules). But this still allows the attacking traffic to hit our dyno and while this attack was managed using that strategy I would think that a larger attack would slow down nginx, even if the server was 403ing the connections en masse.
Short of us running our own reverse proxy, does anyone have a suggestion for a better strategy? Isn't it a major weakness of Heroku's architecture that they route to apps based on the Host: request header rather than assigning IP addresses to dynos? Is that typical for PaaS?
