Questions tagged [cloudflare]
Cloudflare is a Content Delivery Network (CDN).
33
questions
0
votes
2answers
90 views
Does Cloudflare's DNS over TLS (DoT) implement DNSSEC too?
I will shoot the question straight:
I am confused about if I decided to implement DNS over TLS (DoT), would I lose DNSSEC?
Little bit of details:
I am connected with IPv4 + IPv6 Cloudflare DNS ...
8
votes
1answer
1k views
What does using Cloudflares WARP app offer that HTTPS (websites) alongside DNS over HTTPS / TLS doesn't?
Intoduction to Cloudflare WARP
I’ve been looking at Cloudflares WARP app for mobile. It claims to be a VPN but without some of the IP hiding anonymity features normal VPNS have: “Under the covers, ...
2
votes
2answers
143 views
Security implications of Cloudflare's SSL Full mode (not Strict)
Cloudflare enables several options regarding the communication between its servers and our own.
"SSL Full" means Cloudflare encrypts the traffic but doesn't check the validity of our servers'...
-1
votes
1answer
73 views
CDN end to end encryption?
I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did.
Now I'm able to ...
2
votes
1answer
142 views
Seems my CNAMEs got “curled”. Somebody please explain this to me
According to my CloudFlare firewall logs, somebody went through each of my subdomains. My website is not advertised, it doesn't even show on Google unless typing the exact domain name into it. I think ...
0
votes
1answer
64 views
Cloudflare Full Strict HTTPS flow
I would like to understand Cloudflare full(strict) SSL flow.
Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to ...
0
votes
1answer
74 views
Is using Cloudflare, and other services that proxy your site, a security hazard?
If I understand correctly, they can see all the requests that are coming in to your server. So, all POST requests (user credentials, comments user posts, and many more) can be seen by Cloudflare (...
1
vote
0answers
41 views
How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?
Goal
My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX.
I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
3
votes
0answers
138 views
How does Cloudflare negotiate its server certificate?
When I access https://example.com on my company's laptop that has a X509 client certificate installed, using my home internet connection, without using a VPN, the requested page is signed using the ...
4
votes
2answers
210 views
Does Cloudflare masking my IP make my server more secure?
I've heard in a conversation and read in some forum posts that Cloudflare will proxy your IP, hiding it from the public, and this mitigates the risk of an attacker finding your server in the first ...
1
vote
1answer
509 views
Is there any way to pretend like we are routing our request via cloudflare? [closed]
There is this Web App which uses cloudflare and to bypass certain things I had to find a way to access the actual web server directly. I tried numerous things and finally I think I have found the ...
2
votes
4answers
489 views
How do I configure Azure Web Apps so that the only access is via CloudFlare?
I have a Web Apps (Linux) application on Azure, and I added a custom domain which I have protected with CloudFlare.
I added Azure Security Center to my subscription.
At the moment one can access the ...
7
votes
2answers
345 views
Does cloudflare protect against BREACH attacks?
I know that enabling http compression would make a server vulnerable to the BREACH attacks. So we have disabled compression from the server side, tested and it was all good.
Then we implemented ...
-2
votes
2answers
213 views
Did I just find a bug in CloudFlare or is this a feature?
While doing penetration testing for a client I stumbled upon a security incident. CloudFlare promises to hide the origin IP address when using its DNS.
I went to dnsdumpster.com, inputted my client's ...
3
votes
2answers
213 views
How do I prevent traffic on my site from a source other than Cloudflare?
I use Google Cloud Platform to serve the site I manage.
I have one load balancer there, which controls the movement to several virtual machines.
When I came across the problem of DDOS attacks on ...
0
votes
0answers
347 views
Requests logged in Cloudflare as “XSS, HTML Injection - Body”
Rule name: XSS, HTML Injection - Body
Rule: 100096BHTML
Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
1
vote
2answers
456 views
Can't Cloudflare sniff sensitive login data from its users' websites?
So I recently started using the free Cloudflare plan for my website to provide any sort of protection. And I noticed that, given they do the whole "We'll accelerate your website by caching parts of ...
1
vote
0answers
85 views
Bot detection without client script
I am working in a small startup and we are looking for Security tools - mostly WAF and Bot Detection (specifically to identify click fraud).
Some solutions that integrate client side scripts are ...
1
vote
1answer
1k views
How to verify website owner behind CloudFlare SSL?
I went to Bittrex today and noticed the SSL certificate is issued to CloudFlare, not Bittrex, as seen in the screenshot below.
I'm used to seeing information on this screen which can be recognized as ...
1
vote
2answers
131 views
Could the use of Cloudflare's free SSL feature result in loss of availability?
When using Cloudflare's free shared SSL feature, the certificate for your website is shared with dozens of others websites via the use of SANs (Subject Alternate Names).
Of course some of these ...
2
votes
1answer
216 views
Why is TLS1.2 wrapped in TLS1.3?
I was just curious about TLS1.3 which Cloudflare is one of the companies leading the implementation. I then visited blog.cloudflare.com and turned on my Wireshark. I am not 100% clear about all ...
0
votes
1answer
51 views
CentOS payload injection attempts? [duplicate]
My PHP logs have been flooding with seemingly random attempts to access scripts and software which isn't installed on my server. At first, All the attempts came from a single IP, I was using ...
1
vote
0answers
131 views
health check to test haproxy — request deny with 200. good idea?
I have been working on a multi-provider redundant load balancing solution using HAProxy, AWS, and Cloudflare. I have a solution, and I believe it will be secure, but I am looking for further ...
2
votes
2answers
570 views
How does Cloudflare track their client? Tor is not a workaround
I mirrored a ecommerce site using wget. This site seems to use Cloudflare to handle their web traffic.
What's interesting is that after 90 % or so of the mirroring was done, wget started to produce/...
1
vote
0answers
96 views
HSTS over HTTP-CDN-HTTPs chain [closed]
I'm using CloudFlare's flexible SSL:
Flexible SSL: You cannot configure HTTPS support on your origin, even
with a certificate that is not valid for your site. Visitors will be
able to access ...
6
votes
1answer
194 views
How SSL/TLS handshake happens when we use Cloudflare Service?
I was reading about the offerings of the Cloudflare and then I read about the working of Cloudflare.
Based on my understanding, the domain name of my website(alice.com) is resolved to the IP address ...
0
votes
1answer
194 views
SSL to web server from Cloudflare
Hey I have Cloudflare protecting my website. I had a Let's Encrypt SSL certificate encrypting it before. If I send a request and it passes through Cloudflare.
When it gets to my web server will it be ...
0
votes
1answer
214 views
Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?
I know that CDN services usually protect a user by hiding it's original machine's IP and by screening (and banning) any attackers that send too many requests in the form of DDoS.
But should a CDN ...
4
votes
2answers
840 views
How can cloudflare read encrypted request without private key? [duplicate]
We have Cloudflare in our production server and the encryption level is full, not flexible.
This webpage said Cloudflare can decrypt the request. But we didn't give our server's private key to ...
0
votes
1answer
127 views
Cloudflare cipher selection based on AES-NI support
How does Cloudflare selects AES ciphers on devices with AES acceleration and ChaCha on devices without it ?
22
votes
3answers
6k views
How does a company like CloudFlare block bot crawling and email harvesters?
I saw this on CloudFlares homepage:
CloudFlare protects against a range of threats: cross site scripting, SQL injection, comment spam, excessive bot crawling, email harvesters, and more.
How could ...
9
votes
3answers
5k views
How can CloudFlare provide a valid SSL certificate for domains not under its control?
CloudFlare provides a reverse proxy, and it offers SSL support ("flexible", "full", "strict full", and "keyless").
How does CloudFlare manage to get a valid certificate for domains it does not own? ...
1
vote
2answers
9k views
CloudFlare - prompted for “attention required”
I am getting a CloudFlare - attention required / security check prompt on most of the sites I visit through my Macbook running OS X Yosemite, these sites work perfectly on other devices (such as iPad, ...
