3 ms·

Why would you have a CDN configured to cache error responses from the origin? It shouldn't serve those at all. It's also a good idea to whitelist headers and q

Why would you have a CDN configured to cache error responses from the origin? It shouldn't serve those at all. It's also a good idea to whitelist headers and query params your app uses. Better put this sounds like an attack that only works on very poorly configured CDNs.

dpedu 7y ago
A main purpose of a cdn is to protect your resources by using caching. Error pages still require server-side resources to create. Not caching error pages gives attackers an easy way to consume your server's resources a la "DoS".
- mattacular 7y ago
  That is if a hacker can find an endpoint which is erroring, which they shouldn't be able to if you've configured your cdn not to serve errors from the origin in the first place. There's obviously other good reasons not to serve error messages out to the public. Anyway, if you're an attacker it's easier to DDOS against urls that will 404 as those must go back origin anyway typically and likely won't be safe to cache for long even if the cdn is config'd to do so for 4xx responses. To protect against that your cdn provider probably has some sort of ddos protection feature as well though.
  - wbl 7y ago
    If the CDN doesnt serve an error, what pray tell should it return when the request triggers an error on the origin?
    - mattacular 7y ago
      Depends what kind of error you're referring to but if it's a 5xx cdns can be setup to serve a static html. That html can contain as much or as little info about the error (including no info if you think the endpoint is likely to come under attack the page could be disguised as something legit). Of course you should be monitoring for and logging these error responses from the origin and fixing them as soon as possible. The cdn response is just to provide cover. Again, that is if you need or want it. If you want to expose errors to the public go right ahead nobody is going to stop you.

dpedu 7y ago

A main purpose of a cdn is to protect your resources by using caching. Error pages still require server-side resources to create. Not caching error pages gives attackers an easy way to consume your server's resources a la "DoS".

mattacular 7y ago
That is if a hacker can find an endpoint which is erroring, which they shouldn't be able to if you've configured your cdn not to serve errors from the origin in the first place. There's obviously other good reasons not to serve error messages out to the public. Anyway, if you're an attacker it's easier to DDOS against urls that will 404 as those must go back origin anyway typically and likely won't be safe to cache for long even if the cdn is config'd to do so for 4xx responses. To protect against that your cdn provider probably has some sort of ddos protection feature as well though.
- wbl 7y ago
  If the CDN doesnt serve an error, what pray tell should it return when the request triggers an error on the origin?
  - mattacular 7y ago
    Depends what kind of error you're referring to but if it's a 5xx cdns can be setup to serve a static html. That html can contain as much or as little info about the error (including no info if you think the endpoint is likely to come under attack the page could be disguised as something legit). Of course you should be monitoring for and logging these error responses from the origin and fixing them as soon as possible. The cdn response is just to provide cover. Again, that is if you need or want it. If you want to expose errors to the public go right ahead nobody is going to stop you.