6 ms·

I don't really see what the benefit is here for the developer? With HTTP CloudFlare can do caching etc to take load off the origin, but the origin server has to

I don't really see what the benefit is here for the developer? With HTTP CloudFlare can do caching etc to take load off the origin, but the origin server has to deal with each websocket (right?)

jgrahamc 10y ago
All the things CloudFlare provides but not the caching (e.g. WAF, DDoS protection, DNS, SSL, ...)
billmalarky 10y ago
The benefit is this will allow people who previously had to reveal their origin IP (that is non business class users) in order to support websockets will now be able to hide origin behind cloudflare. Cloudflare can't protect you from DOS attacks if the attacker knows the IP address of your origin.
- mmaunder 10y ago
  http://viewdns.info/iphistory/ http://viewdns.info/iphistory/
  - izak30 10y ago
    Pretty trivial to get a new IP address these days.
    - chinathrow 10y ago
      IP enumaration is also pretty trivial. I guess that what attackers might be using to "unhide" domains. Scan the net and request the required domain name?
      - seabee 10y ago
        That won't work if the origin firewall allows only CloudFlare IP ranges.
      - homero 10y ago
        Maybe but this helps https://support.cloudflare.com/hc/en-us/articles/204899617 https://support.cloudflare.com/hc/en-us/articles/204899617
  - CiPHPerCoder 10y ago
    http://viewdns.info/iphistory/?domain=paragonie.com http://viewdns.info/iphistory/?domain=paragonie.com Nope.
jephir 10y ago
The biggest thing for me is that you can use secure WebSockets (wss://) without having to setup TLS on your origin server. This greatly improves the ability to establish WebSocket connections across proxies.
- slrz 10y ago
  So what you want to do is fooling clients into believing there is transport encryption while actually there is none and the communication with the origin server happens in the clear?
  - matt4077 10y ago
    From what I remember, CF actually requires an ssl certificate, but they'll accept a self-signed one (because they already validate ownership themselves.
    - homero 10y ago
      That can be mitmed but they fixed it https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/
  - homero 10y ago
    You're wrong now https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/
    - pfg 10y ago
      It's not wrong, given that it's a reply to this statement: "... without having to setup TLS on your origin server." Strict mode is optional. It's certainly possible (and highly recommended!) to use transport encryption in both directions with CloudFlare, but that's not what jephir described here.
      - 10y ago
jkarneges 10y ago
If you're interested in CDN-like support for WebSockets that reduces burden on the origin server, check out https://fanout.io/ https://fanout.io/ (disclaimer: founder). We translate incoming WebSocket messages into HTTP requests sent to the origin server, and you can send messages to multiple client connections at once using the API.

I don't really see what the benefit is here for the developer? With HTTP CloudFlare can do caching etc to take load off the origin, but the origin server has to deal with each websocket (right?)

jgrahamc 10y ago

All the things CloudFlare provides but not the caching (e.g. WAF, DDoS protection, DNS, SSL, ...)

billmalarky 10y ago

The benefit is this will allow people who previously had to reveal their origin IP (that is non business class users) in order to support websockets will now be able to hide origin behind cloudflare. Cloudflare can't protect you from DOS attacks if the attacker knows the IP address of your origin.

mmaunder 10y ago
http://viewdns.info/iphistory/ http://viewdns.info/iphistory/
- izak30 10y ago
  Pretty trivial to get a new IP address these days.
  - chinathrow 10y ago
    IP enumaration is also pretty trivial. I guess that what attackers might be using to "unhide" domains. Scan the net and request the required domain name?
    - seabee 10y ago
      That won't work if the origin firewall allows only CloudFlare IP ranges.
    - homero 10y ago
      Maybe but this helps https://support.cloudflare.com/hc/en-us/articles/204899617 https://support.cloudflare.com/hc/en-us/articles/204899617
- CiPHPerCoder 10y ago
  http://viewdns.info/iphistory/?domain=paragonie.com http://viewdns.info/iphistory/?domain=paragonie.com Nope.

jephir 10y ago

The biggest thing for me is that you can use secure WebSockets (wss://) without having to setup TLS on your origin server. This greatly improves the ability to establish WebSocket connections across proxies.

slrz 10y ago
So what you want to do is fooling clients into believing there is transport encryption while actually there is none and the communication with the origin server happens in the clear?
- matt4077 10y ago
  From what I remember, CF actually requires an ssl certificate, but they'll accept a self-signed one (because they already validate ownership themselves.
  - homero 10y ago
    That can be mitmed but they fixed it https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/
- homero 10y ago
  You're wrong now https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/
  - pfg 10y ago
    It's not wrong, given that it's a reply to this statement: "... without having to setup TLS on your origin server." Strict mode is optional. It's certainly possible (and highly recommended!) to use transport encryption in both directions with CloudFlare, but that's not what jephir described here.
    - 10y ago

jkarneges 10y ago

If you're interested in CDN-like support for WebSockets that reduces burden on the origin server, check out https://fanout.io/ https://fanout.io/ (disclaimer: founder). We translate incoming WebSocket messages into HTTP requests sent to the origin server, and you can send messages to multiple client connections at once using the API.