34 votes
Accepted

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

This is not about HTML. This is the HTML of Google Chrome, and Cloudflare controls the response HTTP headers, as it should, since it's the HTTP server responding to the request. The Report-To header ...
  • 456
24 votes

Webserver DDOS protection without giving away private keys (https, tls, ssl)

The reason 3rd party DDoS protection services require your private keys, is so they can actually inspect the traffic and act upon that. Without that, they're just analyzing IP streams of encrypted ...
  • 6,788
23 votes
Accepted

How does a company like CloudFlare block bot crawling and email harvesters?

CloudFlare serves as a guard between your webserver and the client. Every content the client receives got provided by your webserver and filtered by CloudFlare. This way, CloudFlare obfuscates email ...
20 votes

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

No, this does not look like a security or privacy issue. It seems your PDF viewer is generating an <embed> element and is adding a non-standard headers attribute. This attribute seems to contain ...
  • 1,068
18 votes
Accepted

What does using Cloudflares WARP app offer that HTTPS (websites) alongside DNS over HTTPS / TLS doesn't?

It looks like Cloudflare WARP uses the Wireguard VPN as the underlying technology to tunnel the traffic between the client and Cloudflare's own servers. This means that everything on this way will be ...
16 votes

How does a company like CloudFlare block bot crawling and email harvesters?

Simple bot behaviour and "normal user" behaviour are noticeable different, and most bots tend to be relatively simple, since it works for the majority of sites. For example, consider arriving on ...
  • 27.2k
15 votes
Accepted

How can CloudFlare provide a valid SSL certificate for domains not under its control?

Simply put, the webmaster of the site uploads the certificate to CloudFlare. See this article for details. The Keyless mode doesn't have this requirement. It uses an on premise key server instead, ...
12 votes

How does a company like CloudFlare block bot crawling and email harvesters?

In addition to James' and Matthew's answer (which are both valid points by the way): Obviously services like CloudFlare have a bunch of detection methods to decide whether or not a client is allowed ...
  • 437
6 votes

Why is TLS1.2 wrapped in TLS1.3?

Your question about the version numbers in TLS 1.3 ClientHello -- note the record version is 1.0 (wire 0301) and message version is 1.2 (wire 0303), and as you note only the supported_versions ...
6 votes
Accepted

Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?

But should a CDN service like Cloudflare protect against Brute Force Attacks... TL;DR: Not should but could - but in case of Cloudflare there is actually such functionality. A CDN is a content ...
6 votes
Accepted

Does Cloudflare masking my IP make my server more secure?

Yes. The idea is that you block all HTTP and HTTPS connections to your server, except those originating from Cloudflare's network. Therefore, your server cannot be attacked directly - all HTTP and ...
  • 19.9k
5 votes
Accepted

Can't Cloudflare sniff sensitive login data from its users' websites?

Now that Cloudflare has access to that data, do people worry about the "malicious Cloudflare employee who steals the login information"? Or do we just trust Cloudflare because it's "just too big to ...
5 votes

Seems my CNAMEs got "curled". Somebody please explain this to me

Can somebody please explain to me how exactly this unscrupulous fella found my CNAMES? No one can know, after the fact, how an UNKNOWN entity managed to get your UNKNOWN content. There are a lot of ...
4 votes
Accepted

How do I configure Azure Web Apps so that the only access is via CloudFlare?

There are two main ways to do this. One is to restrict the allowable origins of web requests, which will need to be done by IP filtering. The other is to require extra authentication - specifically, ...
  • 40.3k
4 votes

Security implications of Cloudflare's SSL Full mode (not Strict)

Issues with SSL Full (not strict) MITM: you can easily put the whole Internet into the scope, and at least your infrastructure provider. With SSL Full you have the following scheme in place: [user] --...
4 votes
Accepted

Rate Limit DNS Subdomain Requests

TL;DR: What you want is not possible due to the way DNS works. DNS does not work like HTTP where some client accesses a server and where this specific client can be rate-limited by this server. ...
4 votes

Webserver DDOS protection without giving away private keys (https, tls, ssl)

If you are after protection from DDoS—i.e. attacks that try to overwhelm your sever with too many requests—only, you don't need to give your TLS certificates to anybody. Generally if you set up a ...
  • 531
3 votes

Does cloudflare protect against BREACH attacks?

Vulnerability scanners can be wrong. They often detect only the circumstances around a vulnerability, like compression, without actually testing to see if that circumstance is vulnerable. It's up to ...
  • 268
3 votes

How do I configure Azure Web Apps so that the only access is via CloudFlare?

One idea I had is to add an Azure Firewall, and set it to white list the CloudFlare IP Addresses, but I wondered if there is an easier way (and anyway I am not sure how to configure it) I'm afraid ...
3 votes
Accepted

How do I prevent traffic on my site from a source other than Cloudflare?

Once you change the public IP address of your site, configure the DNS to point to Cloudflare and forward your request from there, the attacker will always go through the Cloudflare and won't hit your ...
  • 5,541
3 votes

Can't Cloudflare sniff sensitive login data from its users' websites?

You could ask the same question about AWS. In theory, a malicious operator working for Amazon could steal all your encryption keys and other sensitive data straight out of memory from your virtual ...
3 votes
Accepted

How to verify website owner behind CloudFlare SSL?

In this case, you'll have to rely solely on the Browser trust model. Here's a couple reasons why. CloudFlare as Proxy CloudFlare operates by acting as a TLS-terminating proxy. That is - you connect ...
  • 3,988
3 votes
Accepted

SSL to web server from Cloudflare

From Cloudflare Support - SSL FAQ: What do the SSL options mean? Your domain's SSL option determines how Cloudflare connects to your server either using encryption or not. Flexible SSL: ...
  • 3,988
3 votes
Accepted

Does Cloudflare's DNS over TLS (DoT) implement DNSSEC too?

Your question illustrates a wrong assumption. But before going further on that point, DoH/DoT secures the data in transit, while DNSSEC secures the data at rest. Both are orthogonal and I would posit ...
3 votes

No SSL between Cloudflare and S3 static site. A big security issue?

Attackers with limited reach like lokal HotSpots or smaller ISP level will not be able to read the data. The traffic they have access to is between the client and Cloudflare and thus protected by SSL. ...
3 votes

Bypass WAF to perform XSS?

The source snippets you shared show that the application is properly encoding the brackets and other characters needed for this XSS attempt to work, so even though the keywords onerror and alert are ...
  • 6,807
2 votes

How can cloudflare read encrypted request without private key?

One of the ways you use cloudflare is by setting the NS records for your domain to cloudflare's name servers which in turn resolve www.mydomain.com to their IP addresses. This means that when you go ...
  • 4,091
2 votes
Accepted

Cloudflare cipher selection based on AES-NI support

During the TLS handshake the client sends the ciphers it supports in the order of preference. This way a client can signal that it would prefer ChaCha instead of AES ciphers since ChaCha is less ...
2 votes

CloudFlare - prompted for "attention required"

Cloudflare has stored cookies from your macbook, you may have used proxy or violated something earlier and cloudflare stored your cookies, and the cookie is same every time you visit. So everytime you ...
2 votes

How does Cloudflare track their client? Tor is not a workaround

Cloudflare is notoriously unfriendly towards Tor users. Most Cloudflare hosted sites becomes quite patchy when accessed through Tor as Cloudflare rates Tor users as high risk users. It's possible ...
  • 31.1k

Only top scored, non community-wiki answers of a minimum length are eligible