Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cloudflare]

Cloudflare is a Content Delivery Network (CDN).

0
votes
0answers
44 views

How does Cloudflare Flexible SSL work [on hold]

According to the description of Cloudflare SSL service, the flexible mode means that we can get https connection between client and CDN while our server can still use http. I am confused that how can ...
0
votes
0answers
44 views

Requests logged in Cloudflare as “XSS, HTML Injection - Body”

Rule name: XSS, HTML Injection - Body Rule: 100096BHTML Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
1
vote
2answers
204 views

Can't Cloudflare sniff sensitive login data from its users' websites?

So I recently started using the free Cloudflare plan for my website to provide any sort of protection. And I noticed that, given they do the whole "We'll accelerate your website by caching parts of ...
1
vote
0answers
46 views

Bot detection without client script

I am working in a small startup and we are looking for Security tools - mostly WAF and Bot Detection (specifically to identify click fraud). Some solutions that integrate client side scripts are ...
0
votes
0answers
23 views

Cloudflare checking to reach a web site [duplicate]

I recently encountered the message from Cloudflare wanting to check my browser. Can I stop the checking my of browser? It is disruptive to me.
1
vote
1answer
145 views

How to verify website owner behind CloudFlare SSL?

I went to Bittrex today and noticed the SSL certificate is issued to CloudFlare, not Bittrex, as seen in the screenshot below. I'm used to seeing information on this screen which can be recognized as ...
1
vote
2answers
93 views

Could the use of Cloudflare's free SSL feature result in loss of availability?

When using Cloudflare's free shared SSL feature, the certificate for your website is shared with dozens of others websites via the use of SANs (Subject Alternate Names). Of course some of these ...
2
votes
1answer
93 views

Why is TLS1.2 wrapped in TLS1.3?

I was just curious about TLS1.3 which Cloudflare is one of the companies leading the implementation. I then visited blog.cloudflare.com and turned on my Wireshark. I am not 100% clear about all ...
0
votes
1answer
40 views

CentOS payload injection attempts? [duplicate]

My PHP logs have been flooding with seemingly random attempts to access scripts and software which isn't installed on my server. At first, All the attempts came from a single IP, I was using ...
1
vote
0answers
52 views

health check to test haproxy — request deny with 200. good idea?

I have been working on a multi-provider redundant load balancing solution using HAProxy, AWS, and Cloudflare. I have a solution, and I believe it will be secure, but I am looking for further ...
1
vote
2answers
269 views

How does Cloudflare track their client? Tor is not a workaround

I mirrored a ecommerce site using wget. This site seems to use Cloudflare to handle their web traffic. What's interesting is that after 90 % or so of the mirroring was done, wget started to produce/...
1
vote
0answers
81 views

HSTS over HTTP-CDN-HTTPs chain [closed]

I'm using CloudFlare's flexible SSL: Flexible SSL: You cannot configure HTTPS support on your origin, even with a certificate that is not valid for your site. Visitors will be able to access ...
6
votes
1answer
155 views

How SSL/TLS handshake happens when we use Cloudflare Service?

I was reading about the offerings of the Cloudflare and then I read about the working of Cloudflare. Based on my understanding, the domain name of my website(alice.com) is resolved to the IP address ...
0
votes
1answer
152 views

SSL to web server from Cloudflare

Hey I have Cloudflare protecting my website. I had a Let's Encrypt SSL certificate encrypting it before. If I send a request and it passes through Cloudflare. When it gets to my web server will it be ...
0
votes
1answer
156 views

Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?

I know that CDN services usually protect a user by hiding it's original machine's IP and by screening (and banning) any attackers that send too many requests in the form of DDoS. But should a CDN ...
4
votes
2answers
525 views

How can cloudflare read encrypted request without private key? [duplicate]

We have Cloudflare in our production server and the encryption level is full, not flexible. This webpage said Cloudflare can decrypt the request. But we didn't give our server's private key to ...
0
votes
1answer
101 views

Cloudflare cipher selection based on AES-NI support

How does Cloudflare selects AES ciphers on devices with AES acceleration and ChaCha on devices without it ?
22
votes
3answers
5k views

How does a company like CloudFlare block bot crawling and email harvesters?

I saw this on CloudFlares homepage: CloudFlare protects against a range of threats: cross site scripting, SQL injection, comment spam, excessive bot crawling, email harvesters, and more. How could ...
9
votes
3answers
4k views

How can CloudFlare provide a valid SSL certificate for domains not under its control?

CloudFlare provides a reverse proxy, and it offers SSL support ("flexible", "full", "strict full", and "keyless"). How does CloudFlare manage to get a valid certificate for domains it does not own? ...
1
vote
2answers
8k views

CloudFlare - prompted for “attention required”

I am getting a CloudFlare - attention required / security check prompt on most of the sites I visit through my Macbook running OS X Yosemite, these sites work perfectly on other devices (such as iPad, ...