Re:Cloudflare CDN Partial Outage
by bcjordan on Tuesday October 25, 2022 @11:13PM
(#33339381)
Curious what you find happened with that.
On the webdev side—what can be done as extra defense-in-depth step to guard against this kind of issue? Unrelated to Cloudflare I feel like it is a common issue that crops up on even massive sites quite often. Is there some sort of secondary check / content decryption that could be required on the client-side to contain session cookie crossover?
Re:Cloudflare CDN Partial Outage
by rob-olmos on Thursday October 27, 2022 @12:02AM
(#33352929)
Outside of HTTPS, typically it would be tying the session cookie to the IP address or netblock but because it's Cloudflare IPs, for regular browser navigation requests I don't think there's anything that can be done?
On the webdev side—what can be done as extra defense-in-depth step to guard against this kind of issue? Unrelated to Cloudflare I feel like it is a common issue that crops up on even massive sites quite often. Is there some sort of secondary check / content decryption that could be required on the client-side to contain session cookie crossover?