4 ms·

"it's nontrivial for a user to determine whether or not a site is hosted on Cloudflare" It's easy to detect when Cloudflare is being used. There are multiple

by _-- 10y ago

"it's nontrivial for a user to determine whether or not a site is hosted on Cloudflare" It's easy to detect when Cloudflare is being used. There are multiple ways.

gkop 10y ago
Is there a Chrome or Firefox plugin that can detect non-"Full (strict)" and alert me?
- johnp_ 10y ago
  You could try Wappalyzer. Your comment just reminded me of that gem. No security state detection though. May be added if CloudFlare adds an x-cloudflare-crypto header. https://wappalyzer.com/applications https://wappalyzer.com/applications
  - YBMckUGrk4Pk 10y ago
    That might actually be what we're looking for, we assume that cloudflare is already trustworthy since they're performing the MITM - however there is no way for the client to distinguish whether the backend network is in the clear or not without such an indicator. Also this assumes we're OK with Cloudflare to report the backend status accurately and that can't be spoofed as well.