3 ms·
X-CF- seems to be used by some other software. And Cloudflare has plenty of documented headers that don’t start with X. The whole point is that a genuine user
by amluto 2y ago
X-CF- seems to be used by some other software. And Cloudflare has plenty of documented headers that don’t start with X.
The whole point is that a genuine user header should never conflict with a Cloudflare internal header, and a browser should never see an internal header.
- hinkley 2y agoPlease reread the entire thread. We are talking about someone who thinks the header solution is stupid. You are both splitting hairs. Stay on target.
- sitkack 2y agoHaving re-read the thread, I totally agree. What you have listed is table stakes. I'd also say that internal headers would also be encrypted to a narrow protection domain. If all internal headers were prefixed with X-CF-, you could strip them all via SIMD that had no knowledge of any specific header. Hell, you could probably do it on the NIC.