> an attacker can simply add a random query string to bust through the CDN cache You can configure the cache so that they can't do it: https://developers.cloud

> an attacker can simply add a random query string to bust through the CDN cache You can configure the cache so that they can't do it: https://developers.cloudflare.com/cache/troubleshooting/cache-everything-ignore-query-strings/ https://developers.cloudflare.com/cache/troubleshooting/cach... Without knowing their specific configuration, we don't have enough info to complain about that. Also the separate domain doesn't really change much with CF in front. It could be nice for a few reasons, but it's not really bad. If you have a reasonable CDN already, there's really not much point getting a different one.