WAF Loophole attack scenario

Website, Application, Performance Security
1

Lets say I have a service running on IP: XX.YY.ZZ

If I use Cloudflare reverse proxy to XX.YY.ZZ, everything is fine because Cloudflare will only send safe requests to XX.YY.ZZ.

But what if someone somehow finds my service IP somehow? Won’t my service be vulnerable to attacks?

Do companies usually install Cloudflare and also an in-machine WAF too? Thanks.

2

It’s a lot easier to just limit access to your service to connections from Cloudflare IPs.

1 Like
3

Makes sense, Thanks.

4

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.