Posts tagged cloudflare.

Cloudflare resolves dot-segments in a URL only far enough to reject the obvious escapes, then forwards the raw, still-encoded path to your origin, which quietly resolves it the rest of the way. Your edge rules see one path; your server serves another. Cloudflare even warns you about it, in a banner most people scroll past.

I assumed Cloudflare would protect me from all denial-of-service attacks. It doesn't. A reality check on origin IP bypasses, non-HTTP floods, and why the gap between the edge and your kernel matters.