Is using Cloudflare, and other services that proxy your site, a security hazard?

Question

If I understand correctly, they can see all the requests that are coming in to your server. So, all POST requests (user credentials, comments user posts, and many more) can be seen by Cloudflare (responses are protected if your site just allows https). How is having one entity not a security hazard not just for your company, but for the whole internet in general? Or it's not and I'm misunderstanding something?

Answer 1

Your understanding is a little confused, but to address the central question first: Sure, but so is running your server on hardware owned by Amazon or Microsoft or Google, much less ever running apt install or pulling something from NPM or whatever. Just using an operating system you didn't write (or at least audit) yourself, on hardware you didn't personally create, introduces some risk... heck, I bet you even trust Let's Encrypt to have actually verified that the site you sent your password to was owned by StackExchange, rather than just issuing a cert for StackExchange to anybody who wanted one!

People trust Cloudflare for a few reasons:

• The people behind Cloudflare have a reputation. It's a lot harder to get started in a field like that but once you are known to be trustworthy it's your company's most valuable asset.
• It would be devastating to them, as individuals and as a business, if they were ever caught abusing that trust. The amount of money it would take to be worth more than the business as a whole or even any individual stakeholder's share is a lot.
• They make a lot of legally-enforceable guarantees about how they use the access they have to your connections. Again, any breach of that would have to be tremendously valuable to make up for everything they'd lose.

At the end of the day, you have to choose who you trust. Using Cloudflare is definitely exposing yourself to some risks, but they also provide benefits (including security ones).

---

Not really the topic of the post, but you've got some things wrong about the risks.

• If you don't use Cloudflare's proxies to any site with sensitive content (and just use them for DNS configuration and as a caching layer for your static content, with the option of quickly enabling DDOS protection if needed), Cloudflare can't see any of your requests or responses.
• If you enable their proxy for a site, they can see requests and responses involving that site, regardless of whether TLS (HTTPS) is used between the user and the proxy, the proxy and your server, or both. Their proxies have to decrypt the user's request to provide the services you want (like caching responses or dealing with some kinds of attacks), and that means they also need to encrypt the response and could read or edit it before doing so (the user's TLS session is negotiated with Cloudflare, not with your server).
• Putting Cloudflare in charge of your DNS in general, and particularly pointing your DNS entries at their servers and providing them with a valid TLS server cert for your domain names (which is how the proxy works), means Cloudflare is "same-origin" as your actual domain as far as the browser is concerned, and that means Cloudflare could make arbitrary requests against your server and see the responses (even if they somehow weren't visible to the proxy anyhow) just by injecting a script that makes XHR/fetch calls.

Also, Cloudflare has competition. Many cloud providers offer at least some of what Cloudflare does (though often only for back-end server hosted on their cloud), and there exist other companies that provide cloud-hosted reverse proxies for security, reliability, metrics, and/or performance benefits.

Answer 2

In my opinion, the way that most people use cloudflare is a security risk, but not necessarily for the reasons that you may think. Yes, cloudflare, by design is a man-in-the-middle service. As mentioned, this is necessary for them to provide the service that they offer. In my opinion, whether or not it is a security risk for that reason depends on your threat model and what you are doing. For example, I personally would not ever transmit private cryptocurrency keys through a service like cloudflare. However, I personally do use cloudflare for all sorts of things like protecting buisiness and personal websites.

My problem with Cloudflare is that they have a feature called "flexible-ssl" which gives users the illusion that there data is securely being transmitted with TLS. This service encrypts traffic from the users computer to cloudflares servers, but then data from cloudflare to the actual destination server is not encrypted at all. I think this is ridiculous and God only knows how many websites on the internet are setup this way. It would be one thing if there was some way for a user to know about this, like a little orange thing in a padlock icon somewhere.. but as far as I know there is not. I suppose that this setup is "more" secure than no ssl anywhere though...