Re:Curryfinger – Find the Server Behind the CDN
by throwaway744678 on Saturday September 14, 2019 @07:12AM
(#20970075)
Imagine someone with a fully configured HTTPS web server (without a front CDN), that adds Cloudflare in front of it when the load gets higher, and does not bother configuring their firewall.
Re:Curryfinger – Find the Server Behind the CDN
by dalbotex on Saturday September 14, 2019 @08:43AM
(#20970431)
Yeah, that does sound plausible.
Re:Curryfinger – Find the Server Behind the CDN
by rdl on Saturday September 14, 2019 @06:57AM
(#20970034)
Could be a shared hosting platform behind the CDN where the user doesn't have the ability to ip-acl but does have https. Common among low-end users and in the particular case of a "hidden" site, easily purchased cheap VPSes which are de facto anonymous.
Re:Curryfinger – Find the Server Behind the CDN
by CapacitorSet on Saturday September 14, 2019 @09:07AM
(#20970553)
>I just find it odd how someone would go through the trouble of setting up HTTPS (instead of terminating it at the CDN)
At least wrt CloudFlare, it's actually recommended - for privacy reasons, at least so they claim - that you run SSL both between client and CDN, and between CDN and server: https://support.cloudflare.com/hc/en-us/articles/200170416-E...
Re:Curryfinger – Find the Server Behind the CDN
by penagwin on Saturday September 14, 2019 @09:32AM
(#20970656)
Uhh they recommend it so the traffic between your server and cloudflare isn't unencrypted over HTTP
Re:Curryfinger – Find the Server Behind the CDN
by latchkey on Saturday September 14, 2019 @07:14AM
(#20970079)
> then not bother to block traffic from anywhere but the CDN
How can you find that odd when there are so many mongodb instances on the open internet?
Re:Curryfinger – Find the Server Behind the CDN
by dalbotex on Saturday September 14, 2019 @08:45AM
(#20970442)
Because I imagine someone who would expose their mongodb instance to the web would also just terminate HTTPS at the CDN, rendering curryfinger/cloudflare.py useless.
Re:Curryfinger – Find the Server Behind the CDN
by alexhornbake on Saturday September 14, 2019 @08:06AM
(#20970279)
Someone wants to lower their cdn bill, so they serve static things on cdn, and dynamic things from origin.
* The traffic between server and CDN is encrypted using a valid certificate
* The server's firewall is not properly configured
Apparently there are indeed servers with this configuration, but I just find it odd how someone would go through the trouble of setting up HTTPS (instead of terminating it at the CDN) and then not bother to block traffic from anywhere but the CDN.