I need to be able to set the Access-Control-Allow-Origin response header with my server, however when I switch to Under Attack Mode (which I need right now because I'm being DDOSed), Cloudflare scrubs this and a bunch of other headers which is breaking some site functionality I need.

I sent a message to Cloudflare and am waiting to hear back, any ideas in the meantime?

  • In the meantime you could try a different CDN, but DNS caching means that might not be very effective. – Tim Nov 23 '17 at 0:27
  • I switched to a different DDOS mitigation service and the CORS is even more messed up because they scrub even more headers. – Antoine Nov 23 '17 at 2:07
  • There's probably a reason they do that then. – Tim Nov 23 '17 at 2:18
  • @Tim, well it's just CORS, it can be spoofed client side anyways if someone is really eager enough, I think my best bet is to exclude that route from the firewall, I'll talk with Cloudflare and see if that's possible – Antoine Nov 23 '17 at 2:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.