3 ms·

> They're meant as a cache and anti-DDoS proxy more than anything else You can't cache responses to authenticated requests, so in case of DDoS attack against a

> They're meant as a cache and anti-DDoS proxy more than anything else You can't cache responses to authenticated requests, so in case of DDoS attack against an HTTP end point that requires authentication the best CloudFlare can do to safe the back-end is to drop requests, which makes the attack successful. I really can't see benefits of passing authenticated traffic through CloudFlare.

problems 10y ago
That assumes all users who are performing the attack are authenticated - an extremely unlikely scenario. All said users would also have to be able to pass a captcha which gets engaged in the case that a site is under active attack. > the best CloudFlare can do to safe the back-end is to drop requests, which makes the attack successful It can also drop the attack requests, which is generally not from authenticated users, and pass the real traffic to the backend. Only in the case of real user, authenticated traffic is CloudFlare not a solution. In cases of high unauthenticated user or high fake user traffic or in cases of attacks not operating on HTTP at all, CloudFlare will solve the problem perfectly. Some of the nastiest attacks, like reflection attacks, don't even touch HTTP at all but will quickly knock most servers offline - even lead many server providers to nullroute you to protect their other customers. It'll also get you out in cases of high real user, unauthenticated traffic - like being posted on HN, reddit, etc.
mrkurt 10y ago
You can cache authed requests. I'm not sure cloudflare supports it, but it's very common. Even without caching, it's useful to run traffic through frontend servers that are close to users. Terminating SSL as close to visitors as possible speeds things up. Getting visitors off their ISP network and on to quality backhaul helps too.
markonen 10y ago
You aren't typically DDoSed by your authenticated users. Cloudflare can validate authentication tokens at the edge; they also have a feature, Railgun, that can potentially cache portions of those authenticated responses. (No affiliation to Cloudflare, btw)

problems 10y ago

That assumes all users who are performing the attack are authenticated - an extremely unlikely scenario. All said users would also have to be able to pass a captcha which gets engaged in the case that a site is under active attack. > the best CloudFlare can do to safe the back-end is to drop requests, which makes the attack successful It can also drop the attack requests, which is generally not from authenticated users, and pass the real traffic to the backend. Only in the case of real user, authenticated traffic is CloudFlare not a solution. In cases of high unauthenticated user or high fake user traffic or in cases of attacks not operating on HTTP at all, CloudFlare will solve the problem perfectly. Some of the nastiest attacks, like reflection attacks, don't even touch HTTP at all but will quickly knock most servers offline - even lead many server providers to nullroute you to protect their other customers. It'll also get you out in cases of high real user, unauthenticated traffic - like being posted on HN, reddit, etc.

mrkurt 10y ago

You can cache authed requests. I'm not sure cloudflare supports it, but it's very common. Even without caching, it's useful to run traffic through frontend servers that are close to users. Terminating SSL as close to visitors as possible speeds things up. Getting visitors off their ISP network and on to quality backhaul helps too.

markonen 10y ago

You aren't typically DDoSed by your authenticated users. Cloudflare can validate authentication tokens at the edge; they also have a feature, Railgun, that can potentially cache portions of those authenticated responses. (No affiliation to Cloudflare, btw)