4 ms·

Deprecating the __cfduid cookie

65 points by jgrahamc 6y ago

JimWestergren 6y ago
Excellent. The last remaining cookie on many of my sites.
- DoctorOW 6y ago
  Yeah this is going to make cookiefree domains using cloudflare as a CDN be much faster.
up6w6 6y ago
> We’ve learned that it will be possible for us to transition away from using this cookie to detect bots. They could describe better why the cookie is not needed anymore
- Hello71 6y ago
  My guess is that it's less that there are now better ways to do it, and more that bots are increasingly sophisticated and the value of this signal has decreased over time, while the business costs (explaining to customers why this is not a GDPR violation) have increased.
- jgrahamc 6y ago
  There's a long description of what we do here: https://blog.cloudflare.com/cloudflare-bot-management-machine-learning-and-more/ https://blog.cloudflare.com/cloudflare-bot-management-machin...
cj 6y ago
Thanks jgrahamc, this is a very welcomed change.
kevincox 6y ago
Vaguely related... If you are using Cloudflare's bot protection be sure to disable it for asset requests such as JavaScript and CSS. Cloudflare's default behaviour upon detecting a "malicious bot" is to serve a captcha for these requests which will break your site. You should probably only be using this for top-level navigation where the captcha will be visible to use user. This is a bit complicated for API endpoints, in this case all of your JS must be ready to receive an HTML captcha page instead of whatever your API should return. It is unclear what to do in this case. Send the request again? Reload the page and hope that the user gets a captcha on the HTML? I've had Google down-rank my pages because Cloudflare served a captcha instead of the CSS file and Google decided that they weren't "mobile friendly". Side-note: This is extra painful for https://cloudflare-ipfs.com https://cloudflare-ipfs.com as you can't disable security since Cloudflare has picked the settings, it makes that service unusable for hosting website assets.
nojvek 6y ago
Yessss. I always found this weird. I just wanted to use Cloudflare cdn. Not wanting them to track me. Just give me headers with cache hit/miss and edge pop being served from. No cookies.
elissaaa 6y ago
There are no results for d8a9b78c2b95f977e6f41394e5b1ffb3a1607861942 Check your spelling or try different keywords Ref A: 61309E4A8D95406182A0470174AF6ECC Ref B: YMQ01EDGE0515 Ref C: 2020-12-13T12:23:56Z ackers in my PC

65 points by jgrahamc 6y ago

JimWestergren 6y ago

Excellent. The last remaining cookie on many of my sites.

DoctorOW 6y ago
Yeah this is going to make cookiefree domains using cloudflare as a CDN be much faster.

up6w6 6y ago

> We’ve learned that it will be possible for us to transition away from using this cookie to detect bots. They could describe better why the cookie is not needed anymore

Hello71 6y ago
My guess is that it's less that there are now better ways to do it, and more that bots are increasingly sophisticated and the value of this signal has decreased over time, while the business costs (explaining to customers why this is not a GDPR violation) have increased.
jgrahamc 6y ago
There's a long description of what we do here: https://blog.cloudflare.com/cloudflare-bot-management-machine-learning-and-more/ https://blog.cloudflare.com/cloudflare-bot-management-machin...

cj 6y ago

Thanks jgrahamc, this is a very welcomed change.

kevincox 6y ago

Vaguely related... If you are using Cloudflare's bot protection be sure to disable it for asset requests such as JavaScript and CSS. Cloudflare's default behaviour upon detecting a "malicious bot" is to serve a captcha for these requests which will break your site. You should probably only be using this for top-level navigation where the captcha will be visible to use user. This is a bit complicated for API endpoints, in this case all of your JS must be ready to receive an HTML captcha page instead of whatever your API should return. It is unclear what to do in this case. Send the request again? Reload the page and hope that the user gets a captcha on the HTML? I've had Google down-rank my pages because Cloudflare served a captcha instead of the CSS file and Google decided that they weren't "mobile friendly". Side-note: This is extra painful for https://cloudflare-ipfs.com https://cloudflare-ipfs.com as you can't disable security since Cloudflare has picked the settings, it makes that service unusable for hosting website assets.

nojvek 6y ago

Yessss. I always found this weird. I just wanted to use Cloudflare cdn. Not wanting them to track me. Just give me headers with cache hit/miss and edge pop being served from. No cookies.

elissaaa 6y ago

There are no results for d8a9b78c2b95f977e6f41394e5b1ffb3a1607861942 Check your spelling or try different keywords Ref A: 61309E4A8D95406182A0470174AF6ECC Ref B: YMQ01EDGE0515 Ref C: 2020-12-13T12:23:56Z ackers in my PC