🔒Cloudflare Launches OHTTP Gateway, A Privacy-Focused HTTP Proxy
Cloudflare's new proxy keeps your requests private
TL;DR
Cloudflare's OHTTP Gateway encrypts HTTP requests, ensuring the relay can't read them. Ideal for teams needing privacy at the network level, but WAF may stop working.
Cloudflare has opened a closed beta of the OHTTP Gateway, a privacy-focused HTTP proxy that encrypts requests to prevent the relay from reading them. Developers who prioritize network-level privacy should take note, as this tool ensures client IP addresses remain hidden from the relay. The Gateway splits a request across two parties: the client encrypts the inner HTTP request to the gateway's public key, and the relay sees the client's IP but can't decrypt the request. This model requires separate, non-colluding parties to operate the relay and app server. The Gateway binds to a zone and listens at a fixed path, https://your-zone.com/.well-known/ohttp-gateway. It's designed for stateless requests and doesn't touch the inner request body, offering long-lived connections and performance benefits with chunked requests.
Key Points
Cloudflare's OHTTP Gateway splits requests across two parties, with the client encrypting the inner HTTP request to the gateway's public key using HPKE.
The relay sees the client's IP but can't decrypt the request, ensuring privacy at the network level.
Cloudflare's WAF, which relies on TLS Fingerprinting, may stop working if OHTTP is enabled, impacting security features.
The Gateway binds to a zone and listens at https://your-zone.com/.well-known/ohttp-gateway, with HPKE keys managed by Cloudflare.
OHTTP supports both standard and chunked requests, with chunked recommended for performance, and launches this fall with a closed beta now.
Why It Matters
If you're building a privacy-focused app or service, the OHTTP Gateway is a must-have. It ensures your requests remain private at the network level, but be aware that Cloudflare's WAF may stop working if you enable it. This affects teams needing to verifiably promise users they won't inspect logs with client identifiers.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.