Git credential helper vulnerability announced
Learn more about the security vulnerabilities affecting Git 2.26 and older.
Cloudflare for SSH, RDP and Minecraft
Cloudflare now covers SSH, RDP and Minecraft, offering DDoS protection and increased network performance. Spectrum pay-as-you-go now available on all paid plans.
Rolling With The Punches: Shifting Attack Tactics & Dropping Packets Faster & Cheaper At The Edge
Over the past 6 months, volumetric DDoS attacks decreased by 82%. However volumetric attacks are not gone yet, still peaking as high as 418 Gbps. In this post, we cover the changing attack landscape and how Cloudflare adapts and evolves to keep the internet safe.
Free Google Book: Building Secure and Reliable Systems - High Scalability -
Google added another book into their excellent SRE series: Building Secure and Reliable Systems. It's free to download, so don't be shy. It's not short: 557 pages and 21 chapters! So what's it about? In short it's about "reliability through the lens of security." In long, Ana Oprea, one of the authors, gave a good overview. anaoprea: There are multiple questions about what this book is about, who
How To Use 1.1.1.1 w/ WARP App And Cloudflare Gateway To Protect Your Phone From Security Threats
Starting today, you can get even more out of your 1.1.1.1 app. By adding Cloudflare Gateway’s secure DNS filtering to your 1.1.1.1 app, you can add a layer of security and block malicious domains flagged as phishing, command and control, or spam.
Cloudflare now supports security keys with Web Authentication (WebAuthn)!
We’re excited to announce that Cloudflare now supports security keys as a two factor authentication (2FA) method for all users.
Announcing the Results of the 1.1.1.1 Public DNS Resolver Privacy Examination
We took a big step toward improving Internet privacy and security with the launch of the 1.1.1.1 public DNS resolver. And we really meant privacy first. We were not satisfied with the status quo and believed that secure DNS resolution with transparent privacy practices should be the new normal.
Speeding up Linux disk encryption
Encrypting data at rest is vital for Cloudflare with more than 200 data centres across the world. In this post, we will investigate the performance of disk encryption on Linux and explain how we made it at least two times faster for ourselves and our customers!
Six years of the GitHub Security Bug Bounty program
Learn more about the Bug Bounty program, including a recap of 2019’s bugs, our expanded scope, new features, and more.
Deploying security.txt: how Cloudflare’s security team builds on Workers
Today, we’re launching support for the security.txt initiative through Workers to help give security researchers a common location to learn about how to communicate with our team.
CERT partners with GitHub Security Lab for automated remediation
Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we’ll take a deep-dive in the remediation of a security vulnerability with CERT.
Announcing Network Analytics
Back in March 2019, we released Firewall Analytics which provides insights into HTTP security events across all of Cloudflare's protection suite; Firewall rule matches, HTTP DDoS Attacks, Site Security Level which harnesses Cloudflare's threat intelligence, and more.
Dropbox authorization in a Windows Store app
OAuth code flow implementation using Node.JS & Dropbox JavaScript SDK
In this blog post we show you how to implement an OAuth authorization code grant flow using Node.JS and Dropbox JavaScript SDK.
Protecting Security Researchers
Security culture, the Dropbox way
International Women’s Day 2020: Building a Modern Security Team
When we started at Cloudflare in the summer of 2018, we joined a small security team intent on helping it grow quickly. Cloudflare was already a successful “unicorn” startup and its profile was changing fast, providing cyber security protection for millions of Internet-facing properties.
Meet Securitybot: Open Sourcing Automated Security at Scale
Towards better vendor security assessments
Pwned Passwords Padding (ft. Lava Lamps and Workers)
Starting today, we are offering a new security advancement in the Pwned Passwords API - API clients can receive responses padded with random data.
Addressing the Web’s Client-Side Security Challenge
Modern web architecture relies heavily on JavaScript and enabling third-party code to make client-side network requests. These innovations are built on client-heavy frameworks such as Angular, Ember, React, and Backbone that leverage the processing power of the browser
Instant GraphQL Backend with Fine-grained Security Using FaunaDB
GraphQL is becoming popular and developers are constantly looking for frameworks that make it easy to set up a fast, secure and scalable GraphQL API. In this
How To Build A Simple Cryptocurrency Blockchain In Node.js — Smashing Magazine
The blockchain technology is receiving a lot of attention because of its ability to enhance [security](https://www.smashingmagazine.com/category/security) in trustless environments, enforce decentralization, and make processes efficient. In this tutorial, Alfrick Opidi demonstrates how to create a simple cryptocurrency, called `smashingCoin`, using the concepts of JavaScript classes and Node.js. G
GitHub Enterprise Server 2.20 is here
Additional security features, a new internal visibility option, and more with the latest updates to GitHub Enterprise Server 2.20.
Django Highlights: User Models And Authentication (Part 1) — Smashing Magazine
Django is a framework for developing dynamic websites. While a static website is one that solely presents information, there is no interaction that gets registered to a server. In a static website, the server sends HTML, CSS, and JavaScript to a client and that’s it. More capabilities require a dynamic website, where the server stores information and responds to user interaction beyond just servin
HTTPS is Easy!
I've been guilty of publicly bemoaning the complexity of HTTPS. In the past, I've purchased SSL certificates from third-party vendors and had trouble
How To Create A Headless WordPress Site On The JAMstack — Smashing Magazine
In this post, we’ll set up a demo site and tutorial for headless WordPress, including a starter template! We’ll use the WordPress dashboard for rich content editing, while migrating the front-end architecture to the JAMstack to benefit from better security, performance, and reliability. We’ll do this by setting up a Vue application with Nuxt, pulling in the posts from our application via the WordP
A cost-effective and extensible testbed for transport protocol development
At Cloudflare, we develop protocols at multiple layers of the network stack. In the past, we focused on HTTP/1.1, HTTP/2, and TLS 1.3. Now, we are working on QUIC and HTTP/3, which are still in IETF draft, but gaining a lot of interest.
Security on the Internet with Cloudflare for Teams
When Cloudflare launched, businesses bought expensive on-premise hardware to keep their sites online. If they wanted those sites to be faster, or safer, they needed to buy more boxes.
Introducing Cloudflare for Teams
Ten years ago, when Cloudflare was created, the Internet was a place that people visited. People still talked about ‘surfing the web’ and the iPhone was less than two years old, but on July 4, 2009 large scale DDoS attacks were launched against websites in the US and South Korea.
Systems Security: A Primer
Attack of the Blog Spam
Fast builds, secure builds. Choose two
Stripe's continuous integration system is responsible for orchestrating build pipelines and executing tens of thousands of test suites. To meet our exceptionally high security bar, we lean on a combination of open-source tech and novel engineering.
Browser sandbox
To defend against attacks, a developer needs to mitigate vulnerabilities and add security features to an application. Luckily, on the web, the browser provides many security features, including the idea of a "sandbox".
Help users change passwords easily by adding a well-known URL for changing passwords
By redirecting requests to /.well-known/change-password to the change password URL, you can let users update their passwords easier than before.
Cross-Origin Resource Sharing (CORS)
The browser's same-origin policy blocks reading a resource from a different origin for security purposes. Enabling CORS lets the server tell the browser it can use an additional origin.
Content security policy
Content Security Policy can significantly reduce the risk and impact of cross-site scripting attacks in modern browsers.
First-party cookie recipes
Learn how to set first-party cookies to ensure security, cross-browser compatibility, and minimize chances of breakage once third-party cookies are phased out.
Glossary for hacked sites
The glossary covers a collection of technical terms that are referenced throughout our security documentation.
How to set up Signed HTTP Exchanges (SXG) using nginx
How to generate a TLS certificate with SXG extensions, install tools for generating SXG files, and configure nginx to serve SXG files.
Improve security and privacy by updating HTTP Cache
Forgetting or misusing the Cache-Control header might negatively impact the security of your website and your users' privacy. Get recommendations for high-value websites.
Important Security Terminology
Two of the hurdles developers face when migrating to HTTPS are concepts and terminology. This guide provides a brief overview of both.
Media encryption
Learn digital rights management concepts, and the commands needed to get from a raw mov file to encrypted media packaged for MPEG-DASH or HLS using both Clear Key or Widevine encryption.
Sign in with a passkey through form autofill
Create a sign in experience that leverages passkeys while still accommodating existing password users.
Designing the user experience of passkeys on Google accounts
Bringing better security and a better user experience to Google accounts.
Check site security
You won't be able to build a PWA without HTTPS. Serving your site over HTTPS is fundamental for security, and many APIs won't work without it. If you need to justify implementation costs, find out why HTTPS matters.
SameSite cookies explained
Learn to mark your cookies for first-party and third-party usage with the SameSite attribute. You can enhance your site's security by using SameSite's Lax and Strict values to improve protection against CSRF attacks. Specifying the new None attribute lets you explicitly mark your cookies for cross-site usage.
What are security attacks?
An insecure application could expose users and systems to various types of damage. When a malicious party uses vulnerabilities or lack of security features to their advantage to cause damage, it is called an attack. We'll take a look at different types of attacks in this guide so you know what to look for when securing your application.
Security headers quick reference
This article lists the most important security headers you can use to protect your website. Use it to understand web-based security features, learn how to implement them on your website, and as a reference for when you need a reminder.
Security should not be so scary!
When the word "security" comes to mind, it's usually in the context of bad news. But security is something to be taken as a positive and necessary part of web development just like "user experience" or "accessibility".
SMS OTP form best practices
Asking a user to provide a one-time password is a common way to confirm a user's identity. Learn best practices to build an SMS OTP form, with great user experience.
Mitigate cross-site scripting (XSS) with a strict Content Security Policy (CSP)
Learn how to deploy a CSP based on script nonces or hashes as a defense-in-depth against cross-site scripting.
Confound malicious middlemen with HTTPS and HTTP Strict transport security
Prevent creating a new passkey if one exists
Learn how to prevent creating a new passkey if one already exists in the user's password manager.
RP ID deep dive
Learn how to configure your RP ID and platform associations to enable seamless passkey authentication across subdomains, multiple sites, and mobile applications.
Passkeys within iframes
Learn how to securely implement passkeys (WebAuthn) within cross-origin iframes using browser security policies and server-side verification.
Why HTTPS matters
HTTPS protects the integrity of your website, protects the privacy and security of your users, and is a prerequisite for new and powerful web platform APIs.
How the BBC is rolling out HSTS for better security and performance.
The BBC is rolling out HSTS for their website to improve security and performance. Find out what it means, and how HSTS can help you.