3 ms·

Can't be sure, but that would be rather frightening if cloudflare is just injecting JS willynilly

by cududa 4y ago

joshmn 4y ago
If CF is acting as a reverse proxy as it so often does — it's one of their core features — it's not exactly willynilly.
- zo1 4y ago
  This is 90% in similarity to one of the top reasons we are pushing for HTTPS and DoH! The supposed "ISP" inserting "stuff" into our requests. Would be 100% except it's 5% less because the server "agreed" to it, and another 5% because it's not ads, just "tracking js". Maybe knock off an extra 80% because it's "Cloudflare" and they're the new "do no harm" giant like Google.
- tyingq 4y ago
  "about 1 in 5 requests" maybe makes it a little willy-nilly. It's not yet clear what's happening.
  - joshmn 4y ago
    I wasn’t able to reproduce. The error pages do return the code, though, but I was expecting that. I’m hoping that OP can provide a request that does reproduce it.
    - cududa 4y ago
      Sure thing - there's a link at the top of the post with an example of code. HTML is about 200 lines, each one slightly different, did a 3 second wait before each post request (25 posts, 5 with the offending tracking code), used their python API
      - joshmn 4y ago
        Tried with all my might and no dice: https://gist.github.com/joshmn/c87a52b5328aa4f452be7970af4ba407 https://gist.github.com/joshmn/c87a52b5328aa4f452be7970af4ba... Now, are _you_ serving from Cloudflare and you're seeing this in production? Or is this coming from the output?
        cududa 4y ago
        Ah - guess I can reply now here, but HN seems to be rate limiting me - lets perhaps DM on twitter to find repro steps? But to your main question - the resultant HTML is occurring after running a python script fully locally, no hosting, prod, dev server, or anything related to Cloudflare coming into play.
        joshmn 4y ago
        My email's in my profile :)
    - deleted 4y ago
      [deleted]
  - djbusby 4y ago
    That's sampling. Don't inject everytime, just inject 20% of the time.
    - tyingq 4y ago
      Cloudflare doesn't have any sampling setting anywhere close to 20%.
Alupis 4y ago
jffry 4y ago
If you proxy your site through Cloudflare and turn on Cloudflare analytics, its default behavior appears to be to automatically add the JS tag for you in HTML responses [1] (you can also disable that and manually add the tag to your HTML) They provide a lot of this type of thing - rewriting HTML responses with optimizations "at the edge" instead of you doing it at your origin. [1] https://developers.cloudflare.com/analytics/web-analytics/getting-started/ https://developers.cloudflare.com/analytics/web-analytics/ge...

Can't be sure, but that would be rather frightening if cloudflare is just injecting JS willynilly

by cududa 4y ago

Can't be sure, but that would be rather frightening if cloudflare is just injecting JS willynilly

joshmn 4y ago

If CF is acting as a reverse proxy as it so often does — it's one of their core features — it's not exactly willynilly.

zo1 4y ago
This is 90% in similarity to one of the top reasons we are pushing for HTTPS and DoH! The supposed "ISP" inserting "stuff" into our requests. Would be 100% except it's 5% less because the server "agreed" to it, and another 5% because it's not ads, just "tracking js". Maybe knock off an extra 80% because it's "Cloudflare" and they're the new "do no harm" giant like Google.
tyingq 4y ago
"about 1 in 5 requests" maybe makes it a little willy-nilly. It's not yet clear what's happening.
- joshmn 4y ago
  I wasn’t able to reproduce. The error pages do return the code, though, but I was expecting that. I’m hoping that OP can provide a request that does reproduce it.
  - cududa 4y ago
    Sure thing - there's a link at the top of the post with an example of code. HTML is about 200 lines, each one slightly different, did a 3 second wait before each post request (25 posts, 5 with the offending tracking code), used their python API
    - joshmn 4y ago
      Tried with all my might and no dice: https://gist.github.com/joshmn/c87a52b5328aa4f452be7970af4ba407 https://gist.github.com/joshmn/c87a52b5328aa4f452be7970af4ba... Now, are _you_ serving from Cloudflare and you're seeing this in production? Or is this coming from the output?
      - cududa 4y ago
        Ah - guess I can reply now here, but HN seems to be rate limiting me - lets perhaps DM on twitter to find repro steps? But to your main question - the resultant HTML is occurring after running a python script fully locally, no hosting, prod, dev server, or anything related to Cloudflare coming into play.
        joshmn 4y ago
        My email's in my profile :)
  - deleted 4y ago
    [deleted]
- djbusby 4y ago
  That's sampling. Don't inject everytime, just inject 20% of the time.
  - tyingq 4y ago
    Cloudflare doesn't have any sampling setting anywhere close to 20%.

Alupis 4y ago

jffry 4y ago

If you proxy your site through Cloudflare and turn on Cloudflare analytics, its default behavior appears to be to automatically add the JS tag for you in HTML responses [1] (you can also disable that and manually add the tag to your HTML) They provide a lot of this type of thing - rewriting HTML responses with optimizations "at the edge" instead of you doing it at your origin. [1] https://developers.cloudflare.com/analytics/web-analytics/getting-started/ https://developers.cloudflare.com/analytics/web-analytics/ge...