Questions tagged [cdn]

Security practices of as well as security implications of using a Content Delivery Network such as Cloudflare or Akamai.

Filter by
Sorted by
Tagged with
1 vote
1 answer
33 views

Do CloudFront edges talk to custom origins over open (non-AWS) networks?

Where the custom origin server for an AWS CloudFront distribution is an EC2 instance accessible with a public DNS record, do CloudFront edge locations talk to it over the open Internet — as opposed to ...
user avatar
1 vote
1 answer
84 views

DDoS might be very unlikely to happen to my website but in any case a CDN that should protect from it slows my website [closed]

I humbly assume that DDoS is very unlikely to happen to my website. A CDN that should protect from it slows my website according to my personal experience and tests (perhaps only because of the ...
user avatar
1 vote
1 answer
211 views

Can a Man-in-the-Middle-Attack be achieved by adding a cloudfront distribution origin of a domain not owned by me?

Cloudfront supports adding external origins, i.e. domains that are not S3 buckets or ALBs. This led me to wonder whether adding domains that are not owned by the entity as an origin could allow for ...
user avatar
1 vote
2 answers
134 views

Is the idea of a hosting provider with built-in DDoS protection plausible? [closed]

Any PaaS/shared hosting company which I came across offers its customers to protect their websites from DDoS via security-oriented CDNs such as CloudFlare or CloudFront which act as a proxy ...
user avatar
  • 13
1 vote
0 answers
24 views

If and how security-oriented CDNs protect from BFAs? [duplicate]

I understand how some CDNs also suffice protection from DDoS attacks by distributing content serving via various machines instead just one machine so that distributed attacks on one machine become ...
user avatar
  • 11
0 votes
1 answer
146 views

How to know if the response is from the CDN and not the origin?

I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish ...
user avatar
0 votes
1 answer
126 views

CDN vs server-level GeoIP

Suppose a website is set up so that only IPs from country X are allowed read/write access. This server goes through a CDN such as Cloudflare. Because the GeoIP read block is at server level, it never ...
user avatar
  • 1
-1 votes
1 answer
341 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
user avatar
1 vote
1 answer
82 views

Why do CDNs allow arbitrary backend to be set, is it not a big security concern?

I found most CDNs allow the user to claim any domains to be the backend, I wonder why they do this instead of verifying if the user owns the backend domain. If I have myowndomain.com and set the ...
user avatar
  • 665
2 votes
2 answers
164 views

Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?

We have a mobile app (React and Expo) in which the user is able to provide payment via Stripe. Our implementation uses a WebView which renders HTML and JavaScript content, which in turn pulls in the ...
user avatar
  • 123
1 vote
3 answers
455 views

Is it possible to scan the whole IP range to find a domain behind the CDN?

I am very curious if it is possible to find the real IP address of a domain "protected" by a CDN service. For example, www.cnn.com uses Fastly service, and the domain name only resolves to a Fastly ...
user avatar
  • 665
5 votes
2 answers
394 views

Does Cloudflare masking my IP make my server more secure?

I've heard in a conversation and read in some forum posts that Cloudflare will proxy your IP, hiding it from the public, and this mitigates the risk of an attacker finding your server in the first ...
user avatar
  • 336
1 vote
1 answer
149 views

Does a DDOS attack on an application using CDN have to first bring down all the involved CDN servers to affect the application's availability?

CDN are said to absorb and mitigate the Denial of Service and DDOS attacks. Consider an application that uses a CDN provider to deliver its content. So if an attacker tries to bring down such an ...
user avatar
  • 11
7 votes
2 answers
357 views

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack. I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
user avatar
  • 3,496
2 votes
0 answers
137 views

How can an attacker hijack js/css content?

I just encounter an issue, the cached js files showed porn site Here's the simple network diagram. https://cdn.mysite.com/js/app.js shows a porn site, but if I add in query string https://cdn....
user avatar
  • 121
-1 votes
2 answers
144 views

Why do so many websites use third-party sites for hosting JavaScripts?

Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
user avatar
  • 1,616
3 votes
0 answers
106 views

Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts

I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
user avatar
  • 503
2 votes
1 answer
366 views

Is it secure to handle the OAuth 2 Authorization callback from a CDN?

This question is in the context of the OAuth 2.0 Authorization Framework. Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO. Say ...
user avatar
  • 121
-1 votes
2 answers
988 views

What are the damages when a CDN gets hacked?

I was reading about CDN services and how they work. I saw this article about how a US army site got hacked by using a CDN: https://www.welivesecurity.com/2015/06/09/us-army-website-hack/ When ...
user avatar
2 votes
1 answer
555 views

Is there a multi-layered DoS protection which can be tightly integrated with cloud hosting services?

I know that one can deny services (DoS) in any of the 7 layers of the OSI model and that in principle, a denial can be done by a single entity (human or machine) or from 2 or more such entities ("...
user avatar
0 votes
1 answer
529 views

How to ensure the third party CDN is secure (and stays secure)?

Most of the modern applications are using CDN for third party libraries. For example, let's say I use xxxv2.min.js from cdn.example.com/xxxv2.min.js Everything is good, until the day that company has ...
user avatar
1 vote
1 answer
382 views

Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?

I know that CDN services usually protect a user by hiding it's original machine's IP and by screening (and banning) any attackers that send too many requests in the form of DDoS. But should a CDN ...
user avatar
3 votes
1 answer
230 views

How to protect a website from DDoS without a CDN? [closed]

I have basic knowledge in Bash and with that knowledge I rented a remote machine in a mostly-self-managed hosting platform (DigitalOcean) and raised a LEMP environment on which I have a website. I ...
user avatar
5 votes
2 answers
1k views

How can cloudflare read encrypted request without private key? [duplicate]

We have Cloudflare in our production server and the encryption level is full, not flexible. This webpage said Cloudflare can decrypt the request. But we didn't give our server's private key to ...
user avatar
70 votes
2 answers
20k views

How can ISPs handle DDoS attacks?

How can an ISP with low bandwidth like 50 Gbps handle a DDoS attack with more than this? I know there is a solution called "Black Hole". Is this enough to mitigate DDoS attacks or are there any other ...
user avatar
  • 1,617
22 votes
3 answers
6k views

How does a company like CloudFlare block bot crawling and email harvesters?

I saw this on CloudFlares homepage: CloudFlare protects against a range of threats: cross site scripting, SQL injection, comment spam, excessive bot crawling, email harvesters, and more. How could ...
user avatar
  • 64.2k
9 votes
3 answers
6k views

How can CloudFlare provide a valid SSL certificate for domains not under its control?

CloudFlare provides a reverse proxy, and it offers SSL support ("flexible", "full", "strict full", and "keyless"). How does CloudFlare manage to get a valid certificate for domains it does not own? ...
user avatar
  • 1,230
6 votes
3 answers
24k views

What is the Akamai Name Server I see for some big companies?

I have played with DNS a lot lately, and I have found that some big companies' web sites use the Akamai NS as the Name Server for their WWW servers, for example: $>nslookup > www.redhat.com ...
user avatar
  • 1,129