Re:A good day to trie-hard: saving compute 1% at a time
by sitkack on Tuesday September 10, 2024 @01:45PM
(#41503506)
Having re-read the thread, I totally agree. What you have listed is table stakes. I'd also say that internal headers would also be encrypted to a narrow protection domain.
If all internal headers were prefixed with X-CF-, you could strip them all via SIMD that had no knowledge of any specific header. Hell, you could probably do it on the NIC.
The whole point is that a genuine user header should never conflict with a Cloudflare internal header, and a browser should never see an internal header.