I figure it out! about 'HSTS not enforced' warning

[cloudstrife]

Hi CF team,
Today I figured out the ‘HSTS not enforced’ warning in security center.

That’s because ‘Security Center’ blocked/challenged by Firewall Rules. If you open ‘Overview’ page of ‘Firewall’, you should see something like this:

Method
GET

HTTP Version
HTTP/1.1

Host
you host here

Path
/

Query string
Empty query string

User agent
python-urllib3/1.26.7

IP address
2606:4700:1101:0:59f9:ac5f:d53d:3a93

ASN
AS132892 CLOUDFLARE Cloudflare, Inc.

Country
United States

This is the second time I insist that CF team should use a CF-like UA when you send a request to everyone’s website… How hard can it be to change ‘User-Agent’ string when coding?

I have suggested CF team uses a proper UA before:

Could CF add a proper UA in the header of SpeedTest's requests

I finally did a lookup on that one. I believe the Speed Test was developed by an engineer before they joined Cloudflare. It’s the one location in South Carolina.

PS: about RDP warning, I still can’t figure it out. maybe it’s also a bug I think.

[sdayman]

Python, eh? That’s one of the worst user agents I have problems with probing my sites.

I’ll add Cloudflare’s ASN as an Allow and see how it goes.

[cloudstrife]

Honestly, I think there’s a vurnerability if you add CF ASN to your CF firewall whitelist. CF provides serverless service(A.K.A ‘Worker’). It’s very hard to block a CF ip If someone use ‘Worker’ to visit/scan your website illegally. I think we can add CF’s ip to iptables but we should not add CF ASN(without a proper UA) to CF firewall whitelist.

[JoshJ]

Who doesn’t block python these days?

[sdayman]

It did fix the HSTS warning. Now I can get rid of that Allow statement and stop wondering.