Hacker News Reader

Comment by jgrahamc | Hacker News Reader

Also on the subject of not setting cookies. We're killing the __cfduid cookie for all customers: https://news.ycombinator.com/item?id=25357729

View on HN

This is a great move, thank you.

Options to purge analytics data and visitor logs would also be handy to give us more control over our users’ privacy, as well as the ability to transparently see how much of our user data you have collected and for how long it will be retained.

And while I have your ear, please consider supporting web servers hosted on non-default ports, and the setting of custom Host headers behind your reverse proxy. (in self-serve - hosting on privileged ports shouldn’t be a requirement of using your service for both security and IPv4 exhaustion reasons)

Love Cloudflare. It’s good to see your team self-aware about privacy concerns and working to mitigate some.

Thanks. I've passed all this on to the right people.

Can you elaborate on the "custom Host headers" ask?

Are you looking to rewrite the Host header as the request gets passed to the origin (without changing the resolution of the origin)? Or something more like domain fronting?

An example or two would be great so I can share with the team.

A custom Host header passed to the origin that differs from the actual Cloudflare-hosted subdomain, without changing its DNS resolution - correct. This would be helpful when the origin is hosted by an inflexible third party, or as a time saver to quickly switch between environments without needing to modify other parts of the infrastructure.

Example 1: A third-party service does not support custom domains, only responds to "Host: my-company.saas-helpdesk.com". For a clean user experience, I want "support.my-domain.com" to reverse proxy to "my-company.saas-helpdesk.com" while rewriting the Host header to their origin as "Host: my-company.saas-helpdesk.com". (I realize CSP headers and all sorts of pain might happen here - perhaps not the best example - but would be great flexibility to have around)

Example 2: My startup's origin only responds to "Host: beta.mydomain.com", and the developer with access to its code is on vacation. I want to release my product. I point "www.mydomain.com" to the IP hosting "beta.mydomain.com" but since that origin does not respond to "Host: www.mydomain.com" - it does not work. I need a Host header rewrite.

Thank you for your time!

2 is possible with CloudFlare workers. I think 1 is as well.

Unfortunately we (Cloudflare) can't allow Host header rewrites like this as they could be used to bypass other customers' Cloudflare security settings. However, both of your examples can be done with Workers. I wrote a more detailed explanation a while back here: https://news.ycombinator.com/item?id=25058579

So it's okay for users savvy-enough to write Workers to bypass other customers' security settings - but not for self-serve point-and-click customers to do the same. Interesting. I suppose users of Workers are more likely to have a verified payment method and thus are less likely to be engaged in suspicious behavior. Thanks for the link.

No no no, you misunderstood. The whole post I linked you to was about why Workers does not allow forged Host headers.

What Workers does allow is for you to send a request to a different hostname. In this case, the Host header matches the DNS lookup. So if the third party is on Cloudflare, the request will go through their Cloudflare security settings.

It also allows, via the `resolveOverride` option, for you to do DNS lookup that doesn't match the Host header, as long as the Host header specifies a hostname within your domain. You can't forge a Host header specifying someone else's domain.

You can technically do that already with Workers: https://developers.cloudflare.com/workers/examples

Cloudflare is moving at an eye-watering pace and I can only imagine it's a testament to the environment you've helped build. I'm amazed at your product velocity and I have to say thanks as a customer, observer and shareholder :)

Are you giving up functionality by doing so or accomplishing same goal via an alternate implementation?

Reply on news.ycombinator.com