News for hackers. Stuff that matters.

A comment on OVH CEO: Unlike Amazon, Google, “we will never be in competition with you”. Parent comment

Re:OVH CEO: Unlike Amazon, Google, “we will never be in comp... by tedivm on Saturday March 31, 2018 @07:09PM (#16725652)
The Fastly "Purge API" by default does not require authentication. This is why you can clear the cache on Github pages directly [1].

From there you can force requests to hit the origin server by first purging the data from the cache and then requesting it.

Unrelated to DDoS I've also seen issues with the Fastly routing- it doesn't always pick the greatest end node to have a client connect to.

[1] https://stackoverflow.com/questions/26898052/how-to-force-im...

[ Parent | on HN ]
Re:OVH CEO: Unlike Amazon, Google, “we will never be in comp... by greenleafjacob on Saturday March 31, 2018 @07:14PM (#16725672)
For what it’s worth I think with custom VCL you could add your own shared key / password authentication to fix this by returning a synthetic 403 if the shared key isn’t present in a header.
[ Parent | on HN ]