Questions tagged [cdn]
Security practices of as well as security implications of using a Content Delivery Network such as Cloudflare or Akamai.
32
questions
70
votes
2
answers
21k
views
How can ISPs handle DDoS attacks?
How can an ISP with low bandwidth like 50 Gbps handle a DDoS attack with more than this? I know there is a solution called "Black Hole".
Is this enough to mitigate DDoS attacks or are there any other ...
- 1,627
22
votes
3
answers
6k
views
How does a company like CloudFlare block bot crawling and email harvesters?
I saw this on CloudFlares homepage:
CloudFlare protects against a range of threats: cross site scripting, SQL injection, comment spam, excessive bot crawling, email harvesters, and more.
How could ...
- 65.4k
10
votes
3
answers
7k
views
How can CloudFlare provide a valid SSL certificate for domains not under its control?
CloudFlare provides a reverse proxy, and it offers SSL support ("flexible", "full", "strict full", and "keyless").
How does CloudFlare manage to get a valid certificate for domains it does not own? ...
- 1,260
7
votes
2
answers
468
views
How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?
I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack.
I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
- 4,066
6
votes
3
answers
24k
views
What is the Akamai Name Server I see for some big companies?
I have played with DNS a lot lately, and I have found that some big companies' web sites use the Akamai NS as the Name Server for their WWW servers, for example:
$>nslookup
> www.redhat.com
...
- 1,119
6
votes
2
answers
2k
views
How can cloudflare read encrypted request without private key? [duplicate]
We have Cloudflare in our production server and the encryption level is full, not flexible.
This webpage said Cloudflare can decrypt the request. But we didn't give our server's private key to ...
- 61
5
votes
2
answers
692
views
Does Cloudflare masking my IP make my server more secure?
I've heard in a conversation and read in some forum posts that Cloudflare will proxy your IP, hiding it from the public, and this mitigates the risk of an attacker finding your server in the first ...
- 376
3
votes
3
answers
645
views
Is it possible to scan the whole IP range to find a domain behind the CDN?
I am very curious if it is possible to find the real IP address of a domain "protected" by a CDN service.
For example, www.cnn.com uses Fastly service, and the domain name only resolves to a Fastly ...
- 695
3
votes
1
answer
235
views
Is sharing private key with CDN dangerous?
When you use a Content Delivery Network (CDN) and want to enable HTTPS, you need to import your certificate there. So you should provide your Private Key to the CDN. Is this secure? I mean CDN can log ...
- 169
3
votes
1
answer
448
views
Is it secure to handle the OAuth 2 Authorization callback from a CDN?
This question is in the context of the OAuth 2.0 Authorization Framework.
Consider a web application that is backed by a first-party API but relies on a third-party authorization server for SSO.
Say ...
- 131
3
votes
1
answer
282
views
How to protect a website from DDoS without a CDN? [closed]
I have basic knowledge in Bash and with that knowledge I rented a remote machine in a mostly-self-managed hosting platform (DigitalOcean) and raised a LEMP environment on which I have a website.
I ...
3
votes
0
answers
157
views
Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts
I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
- 513
2
votes
2
answers
321
views
Bypass network security filters with CDN
I read about Domain Fronting technique, it bypasses network security filters but requires a relatively complex configuration (having evil.com pointing to a.cdn.net, and good.com pointing to b.cdn.net, ...
- 23
2
votes
2
answers
135
views
Do CloudFront edges talk to custom origins over open (non-AWS) networks?
Where the custom origin server for an AWS CloudFront distribution is an EC2 instance accessible with a public DNS record, do CloudFront edge locations talk to it over the open Internet — as opposed to ...
- 768
2
votes
2
answers
187
views
Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?
We have a mobile app (React and Expo) in which the user is able to provide payment via Stripe. Our implementation uses a WebView which renders HTML and JavaScript content, which in turn pulls in the ...
- 123
2
votes
1
answer
578
views
Is there a multi-layered DoS protection which can be tightly integrated with cloud hosting services?
I know that one can deny services (DoS) in any of the 7 layers of the OSI model and that in principle, a denial can be done by a single entity (human or machine) or from 2 or more such entities ("...
user123574
2
votes
0
answers
152
views
How can an attacker hijack js/css content?
I just encounter an issue, the cached js files showed porn site
Here's the simple network diagram.
https://cdn.mysite.com/js/app.js shows a porn site, but if I add in query string
https://cdn....
- 121
1
vote
1
answer
470
views
Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?
I know that CDN services usually protect a user by hiding it's original machine's IP and by screening (and banning) any attackers that send too many requests in the form of DDoS.
But should a CDN ...
1
vote
1
answer
164
views
Does a DDOS attack on an application using CDN have to first bring down all the involved CDN servers to affect the application's availability?
CDN are said to absorb and mitigate the Denial of Service and DDOS attacks. Consider an application that uses a CDN provider to deliver its content. So if an attacker tries to bring down such an ...
- 11
1
vote
2
answers
143
views
Is the idea of a hosting provider with built-in DDoS protection plausible? [closed]
Any PaaS/shared hosting company which I came across offers its customers to protect their websites from DDoS via security-oriented CDNs such as CloudFlare or CloudFront which act as a proxy ...
- 13
1
vote
1
answer
94
views
DDoS might be very unlikely to happen to my website but in any case a CDN that should protect from it slows my website [closed]
I humbly assume that DDoS is very unlikely to happen to my website.
A CDN that should protect from it slows my website according to my personal experience and tests (perhaps only because of the ...
1
vote
1
answer
480
views
Can a Man-in-the-Middle-Attack be achieved by adding a cloudfront distribution origin of a domain not owned by me?
Cloudfront supports adding external origins, i.e. domains that are not S3 buckets or ALBs. This led me to wonder whether adding domains that are not owned by the entity as an origin could allow for ...
- 13
1
vote
1
answer
89
views
Why do CDNs allow arbitrary backend to be set, is it not a big security concern?
I found most CDNs allow the user to claim any domains to be the backend, I wonder why they do this instead of verifying if the user owns the backend domain. If I have myowndomain.com and set the ...
- 695
1
vote
0
answers
24
views
If and how security-oriented CDNs protect from BFAs? [duplicate]
I understand how some CDNs also suffice protection from DDoS attacks by distributing content serving via various machines instead just one machine so that distributed attacks on one machine become ...
- 11
0
votes
1
answer
717
views
How to ensure the third party CDN is secure (and stays secure)?
Most of the modern applications are using CDN for third party libraries. For example, let's say I use xxxv2.min.js from cdn.example.com/xxxv2.min.js
Everything is good, until the day that company has ...
- 137
0
votes
1
answer
140
views
CDN vs server-level GeoIP
Suppose a website is set up so that only IPs from country X are allowed read/write access. This server goes through a CDN such as Cloudflare.
Because the GeoIP read block is at server level, it never ...
- 1
0
votes
0
answers
93
views
Is this web cache poisoning attempt correct?
So i've been trying to learn cache poisoning for a while and today i thought i finally found a vulnerable instance. Everything seems to be working even tho it doesn't. Like, 416 response is cached, ...
- 1
0
votes
2
answers
142
views
DomainFronting - re-routing and SSL certificats
I'm looking for a specific answer regarding the TLS handshake in a scenario of domain-fronting.
Following hensonsecurity and zscaler blogs I have noticed that a detailed description regarding the re-...
0
votes
1
answer
393
views
How to know if the response is from the CDN and not the origin?
I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish ...
- 3
-1
votes
2
answers
150
views
Why do so many websites use third-party sites for hosting JavaScripts?
Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
- 1,726
-1
votes
2
answers
1k
views
What are the damages when a CDN gets hacked?
I was reading about CDN services and how they work. I saw this article about how a US army site got hacked by using a CDN:
https://www.welivesecurity.com/2015/06/09/us-army-website-hack/
When ...
- 21
-1
votes
1
answer
495
views
CDN end to end encryption?
I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did.
Now I'm able to ...
