Hacker News Reader

Comment by MichaelApproved | Hacker News Reader

Would you mind posting the types of problems you've had? I use CF for many critical websites I manage and haven't noticed any problems.

View on HN

Timeouts are the majority of the issues, when our service is running perfectly fine otherwise.

They have often been short, but sometimes long enough to cause me to sit there and flip DNS for various end points away from them until the issue is resolved.

I'm in financial services...as part of our checkout process, the customer downloads a 1 MB pdf with sensitive and unique data to them. In testing ( a test site with cloudflare set up), everything was fine. In production, apparently cloudflare cached these pdfs after some sort of traffic threshold was reached (I guess they are all very similar in size...though they are probably not exactly the same size.) Now customers are calling that they are getting other people's data! Apparently cloudflare caches files without even comparing hashes of the download first. Needless to say, we entirely shut off any and all caching after that.

I feel like any CDN or caching proxy (which might even happen at the ISP level if you aren't using HTTPS!) would have that same issue. You should serve confidential files from unique URLs or at least set the right HTTP headers to disable caching.

I am almost sure you did set up this, but worth asking anyway. Was it "Cache-Control: private no-store", right?

If CF download the file to check the hash, it wouldn't really be helpful as a caching service. That would mean CF would hit your server for each request before it served up the asset to the customer. Your server wouldn't benefit from caching. Maybe you'd get a small speed increase from their worldwide endpoints but that would reduce the advantage of having CF manage your site. One of the biggest advantages is that CF serves hits that your server wouldn't have to. That allows you to need less infrastructure.

Further, it might be better to never serve sensitive financial data via a 3rd party server. That kind of data would be best served directly to the customer's browser from your server.

Most of the times cloudflare is fine, they've gotten a lot better over the years.

However we have found random areas to temporarily go down for random periods of times. You will not be able to see these downtimes if you are only checking from 1 location.

I don't use CF-CDN but some websites that use CF gives me 50x error because it lost connection to origin servers, but when I switch to my VPN service those websites were up. Most of the time I get errors from CF's HKG point.

Reply on news.ycombinator.com