34 ms·
Good points. That raises an interesting question: how could a person determine if the connection between an edge (say, Cloudflare) and the destination server i
by brobinson 11y ago
Good points.
That raises an interesting question: how could a person determine if the connection between an edge (say, Cloudflare) and the destination server is actually encrypted? I can't think of a way to do this unless you know the address of the true IP of the destination and poke it on the SSL port. That still doesn't guarantee SSL is being used, though.
- gojomo 11y agoIn general there's no way to know: you have to trust the destination's internal choices, once you've reached their chosen perimeter. In my opinion best practice would be to obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare. (I don't know if Cloudflare offers any options for this stronger than trusting their IP ranges, such as a client certificate on their outbound-SSL.) So if you could "poke [the true origin] on the SSL port", that could itself be evidence of suboptimal security.
- brobinson 11y ago>obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare This is what I was planning to do when I launch the app I'm working on now. Thanks for the reply.