Hacker News new | ask | show | jobs
by viraptor 1071 days ago
There are two ways you can handle this:

- accept traffic only from the published CloudFlare IP ranges

- connect to CloudFlare rather than accept traffic (Argo tunnel)

The first one unfortunately doesn't protect you from someone scanning from the CloudFlare ranges themselves. You can add a custom header in that case so that any traffic without the shared secret is not accepted.