Questions about how WARP works

[plarhu334]

I have questions regarding how WARP works, specifically relating to how it injects the x-forwarded-for header on the sites it visits. Does WARP (proxy) establish a TCP connection with the user’s device (client) and form subsequent TCP connections as the client tries to access new sites (servers), rather than allowing the client to directly establish a TCP connection with each server, or is it possible to inject headers on an HTTPS connection without needing to decrypt the data? Nowhere is it indicated that WARP is decrypting the data users are sending to it, which would pose a large privacy and security threat.

[plarhu334]

please forgive me, I confused TLS with TCP

[jnperamo]

@plarhu334

Nowhere is it indicated that WARP is decrypting the data users are sending to it, which would pose a large privacy and security threat.

It certainly is if you have the Layer7 firewall enabled.

TLS decryption · Cloudflare Zero Trust docs

@plarhu334

or is it possible to inject headers on an HTTPS connection without needing to decrypt the data?

It’s not the client who sets this header, otherwise anybody could spoof the IP to be anything so whether WARP decrypts the traffic or not is irrelevant in this aspect as it’s something CF sets on the edge.

[plarhu334]

I see. Thank you