4 ms·
> If a Cloudflare customer has configured their origin server to respond only to Cloudflare IPs, then they MUST also verify that the "Host" header on any reques
by aeyes 6y ago
> If a Cloudflare customer has configured their origin server to respond only to Cloudflare IPs, then they MUST also verify that the "Host" header on any request actually matches their domain name.
The worker code sends the correct host name.
https://github.com/jychp/cloudflare-bypass/blob/dd7c1cfc2e6b43d729333ed6b3736925cbc4aea1/cfproxy.py#L33 https://github.com/jychp/cloudflare-bypass/blob/dd7c1cfc2e6b...
- kentonv 6y agoRight. If the hostname requested by the worker is a host that is itself protected by Cloudflare, then all of that host's usual security settings apply. Nothing is bypassed. The author of the blog post seems to have been confused by the fact that different behavior happens if the target host is on Cloudflare vs. not on Cloudflare.