Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Security at the Edge: WAF, DDoS Protection, Rate Limiting, Bot Management and Locking Down the Origin
The WAF, DDoS protection, rate limits and bot rules at the edge only see traffic that goes through the edge; if the origin's IP leaks they are all bypassed, so the origin must accept connections only from the CDN. On an Nginx edge we see a login rate limit stop an attack before it reaches the origin, how forwarded header order in the ASP.NET Core rate limiter protects customers, and why an IP allowlist must be completed with Authenticated Origin Pulls, a tunnel or X-Azure-FDID.
Putting Bookstore Behind Cloudflare: Proxying, SSL/TLS Modes, Cache Rules and the Real Client IP
Moving to Cloudflare means moving the nameservers, keeping web records proxied and mail records DNS-only, choosing Full (strict) as the SSL/TLS mode, writing Cache and Redirect Rules instead of Page Rules, and trusting CF-Connecting-IP at the origin only for connections from Cloudflare's IP ranges. In a lab we see the redirect loop Flexible mode produces, tests that reject spoofed headers with KnownIPNetworks in ASP.NET Core, and the Azure Front Door equivalents.