3 ms·

> At this point you can request any site using Cloudflare I don't see why I can't request any site on the internet whatsoever, having legit Cloudflare IP addre

• judge2020 6y ago
  1. They limit subrequests to 50 per workers request 2. they have abuse alarms for obvious "spray requests by utilizing Workers" behavior (although we don’t know how well these might work) 2. The Cf-Connecting-Ip header is passed with the correct originating request IP, so if a website at least partially trusts CF (without directly using CF's proxy) they can match based on this header if the REMOTE_ADDR is Cloudflare. They could also block requests with the header Cf-Worker[0]. 3. You can't forge the HOST header on CF, so if a website does use CF you can't bypass the actual CF proxy firewall by fetching the IP and setting the HOST header yourself (you can do it within your zone though)[1]. 0: https://community.cloudflare.com/t/is-the-cf-worker-header-from-worker-fetch-reliable/185560/2?u=judge https://community.cloudflare.com/t/is-the-cf-worker-header-f... 1: https://developers.cloudflare.com/workers/runtime-apis/request#requestinitcfproperties https://developers.cloudflare.com/workers/runtime-apis/reque... (resolveOverride)
  • toredash 6y ago
    I believe you can with Enterprise plan, override the Host header that is.