Authenticated Origin Pulls
An origin authentication mechanism provided by Cloudflare that uses mutual TLS certificates to ensure only Cloudflare edge nodes can make requests to the origin, preventing attackers from connecting directly to the origin and bypassing protections.
Timeline (last 90 days)
Combined with origin IP allowlists and Authenticated Origin Pulls, this can significantly reduce the risk of attackers bypassing the CDN to connect directly to the origin or forging origin-bound requests.
At the load balancer layer, only CDN IP ranges should be accepted, ideally requiring mutual TLS between the edge and the origin (which Cloudflare calls Authenticated Origin Pulls), and per-client rate limits, connection limits, client body/header timeouts and maximum body size should be set. The key lines return a cheap 404 for sensitive patterns, such as `location ~ /\.(?!well-known) { return 404; }` and `location ~* \.(env|ya?ml|sql|bak|old|log)$ { return 404; }`.
All Facts (2)
Combined with origin IP allowlists and Authenticated Origin Pulls, this can significantly reduce the risk of attackers bypassing the CDN to connect directly to the origin or forging origin-bound requests.
50%UnverifiedAt the load balancer layer, only CDN IP ranges should be accepted, ideally requiring mutual TLS between the edge and the origin (which Cloudflare calls Authenticated Origin Pulls), and per-client rate limits, connection limits, client body/header timeouts and maximum body size should be set. The key lines return a cheap 404 for sensitive patterns, such as `location ~ /\.(?!well-known) { return 404; }` and `location ~* \.(env|ya?ml|sql|bak|old|log)$ { return 404; }`.
50%