Skip to main content

Questions tagged [cdn]

Security practices of as well as security implications of using a Content Delivery Network such as Cloudflare or Akamai.

5 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
191 views

Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts

I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
Cyassin's user avatar
  • 525
2 votes
0 answers
177 views

How can an attacker hijack js/css content?

I just encounter an issue, the cached js files showed porn site Here's the simple network diagram. https://cdn.mysite.com/js/app.js shows a porn site, but if I add in query string https://cdn....
Js Lim's user avatar
  • 121
1 vote
0 answers
42 views

3rd-Party CDN SSL Inspection for Financial/Banking API Traffics

We have 3rd-Party CDN in front of Financial/Banking APIs which involves sensitive data, login, access token, cookies, etc. We would like to leverage WAF and SSL Inspection capability of CDN. This ...
bboy's user avatar
  • 13
0 votes
1 answer
450 views

Is polyfill.io still an immediate threat?

Polyfill.io is malicious: https://dev.to/snyk/polyfill-supply-chain-attack-embeds-malware-in-javascript-cdn-assets-55d6 https://www.sonatype.com/blog/polyfill.io-supply-chain-attack-hits-100000-...
telion's user avatar
  • 111
0 votes
2 answers
210 views

DomainFronting - re-routing and SSL certificats

I'm looking for a specific answer regarding the TLS handshake in a scenario of domain-fronting. Following hensonsecurity and zscaler blogs I have noticed that a detailed description regarding the re-...
user281868's user avatar