The Cloudflare Blog

Subscribe to receive notifications of new posts:

Addressing

HTTPS-only for Cloudflare APIs: shutting the door on cleartext traffic

2025-03-20

We are closing the cleartext HTTP ports entirely for Cloudflare API traffic. This prevents the risk of clients unintentionally leaking their secret API keys in cleartext during the initial request. ...

Suleman Ahmad
Ash Pallarito
Algin Martin

HTTPS-only for Cloudflare APIs: shutting the door on cleartext traffic

How we prevent conflicts in authoritative DNS configuration using formal verification

2024-11-08

DNS Research Addressing Formal Methods

We describe how Cloudflare uses a custom Lisp-like programming language and formal verifier (written in Racket and Rosette) to prevent logical contradictions in our authoritative DNS nameserver’s behavior....

James Larisch
Suleman Ahmad
Marwan Fayed