Questions tagged [cdn]

Security practices of as well as security implications of using a Content Delivery Network such as Cloudflare or Akamai.

Filter by
Sorted by
Tagged with
4
votes
2answers
118 views

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack. I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
2
votes
1answer
471 views

Is there a multi-layered DoS protection which can be tightly integrated with cloud hosting services?

I know that one can deny services (DoS) in any of the 7 layers of the OSI model and that in principle, a denial can be done by a single entity (human or machine) or from 2 or more such entities ("...
3
votes
3answers
19k views

What is the Akamai Name Server I see for some big companies?

I have played with DNS a lot lately, and I have found that some big companies' web sites use the Akamai NS as the Name Server for their WWW servers, for example: $>nslookup > www.redhat.com ...
2
votes
0answers
81 views

How can an attacker hijack js/css content?

I just encounter an issue, the cached js files showed porn site Here's the simple network diagram. https://cdn.mysite.com/js/app.js shows a porn site, but if I add in query string https://cdn....
-1
votes
2answers
93 views

Why do so many websites use third-party sites for hosting JavaScripts?

Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
3
votes
0answers
43 views

Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts

I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
2
votes
1answer
154 views

Is it secure to handle the OAuth 2 Authorization callback from a CDN?

This question is in the context of the OAuth 2.0 Authorization Framework. Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO. Say ...
-3
votes
2answers
295 views

What are the damages when a CDN gets hacked?

I was reading about CDN services and how they work. I saw this article about how a US army site got hacked by using a CDN: https://www.welivesecurity.com/2015/06/09/us-army-website-hack/ When ...
59
votes
2answers
14k views

How can ISPs handle DDoS attacks?

How can an ISP with low bandwidth like 50 Gbps handle a DDoS attack with more than this? I know there is a solution called "Black Hole". Is this enough to mitigate DDoS attacks or are there any other ...
-2
votes
1answer
272 views

How to ensure the third party CDN is secure (and stays secure)?

Most of the modern applications are using CDN for third party libraries. For example, let's say I use xxxv2.min.js from cdn.example.com/xxxv2.min.js Everything is good, until the day that company has ...
3
votes
1answer
165 views

How to protect a website from DDoS without a CDN? [closed]

I have basic knowledge in Bash and with that knowledge I rented a remote machine in a mostly-self-managed hosting platform (DigitalOcean) and raised a LEMP environment on which I have a website. I ...
0
votes
1answer
170 views

Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?

I know that CDN services usually protect a user by hiding it's original machine's IP and by screening (and banning) any attackers that send too many requests in the form of DDoS. But should a CDN ...
22
votes
3answers
6k views

How does a company like CloudFlare block bot crawling and email harvesters?

I saw this on CloudFlares homepage: CloudFlare protects against a range of threats: cross site scripting, SQL injection, comment spam, excessive bot crawling, email harvesters, and more. How could ...
9
votes
3answers
5k views

How can CloudFlare provide a valid SSL certificate for domains not under its control?

CloudFlare provides a reverse proxy, and it offers SSL support ("flexible", "full", "strict full", and "keyless"). How does CloudFlare manage to get a valid certificate for domains it does not own? ...
4
votes
2answers
605 views

How can cloudflare read encrypted request without private key? [duplicate]

We have Cloudflare in our production server and the encryption level is full, not flexible. This webpage said Cloudflare can decrypt the request. But we didn't give our server's private key to ...