3 ms·
I encountered an impossible situation working on a wordpress site the client insisted needed to be fully reachable via Tor. Parts of the page loaded from a clou
by noonespecial 11y ago
I encountered an impossible situation working on a wordpress site the client insisted needed to be fully reachable via Tor. Parts of the page loaded from a cloudflare CDN but the main site didn't. The user was never presented with the CAPTCHA of course, 3/4 of the page was just missing with no explanation. I never did find a way around that.
- jobbleobble 11y agoAs mentioned in the article, if you control the cloudflare CDN you can now whitelist all tor access.
- dsl 11y agoI think he is talking about https://cdnjs.com/ https://cdnjs.com/ I'd really hope that CloudFlare whitelists Tor for CDNJS.
- rdl 11y agoProbably not cdnjs -- there are lots of people who use CloudFlare for an assets domain (since it's free) -- if they are just serving images, it's a problem to display the CAPTCHA. It is probably best practice, if none of those assets are sensitive, to disable as much security as possible on that domain. It might be worth having some packages of defaults for tuning that. (One of the benefits for our enterprise customers is one of our staff works with them to tune settings.)