I don't know, and that's why I want a WAF without a CDN. I don't need a CDN at all, and I wish I could disable Cloudflare's. But per RFC 9110 [^0], "the Date h

I don't know, and that's why I want a WAF without a CDN. I don't need a CDN at all, and I wish I could disable Cloudflare's. But per RFC 9110 [^0], "the Date header field represents the date and time at which the message was originated." The message comes from my server, not Cloudflare. If they're getting the message from me, i.e. it's not cached by their CDN, they should leave the Date header alone because the message didn't originate with them. [^1] Maybe I have a misunderstanding of where Cloudflare sits as the "origin server" when their CDN isn't used for caching (i.e. it's bypassed as much as is allowable). I would think my server is the "origin" and theirs is the "edge." And unfortunately, workers do not allow you to set the Date header -- Cloudflare support and I already tried that a couple years back (i.e. setting Date = Keygen-Date via a worker). I will take a look at 2. I doubt that'd work, but it's worth a try. [^0]: https://www.rfc-editor.org/rfc/rfc9110.html#name-date https://www.rfc-editor.org/rfc/rfc9110.html#name-date [^1]: https://httpwg.org/specs/rfc7230.html#rfc.section.5.7.2 https://httpwg.org/specs/rfc7230.html#rfc.section.5.7.2