Identity and security

Ingress and egress

Trusted edge traffic, client-IP derivation, SSRF defenses, and approved outbound capabilities.

v1 design baseline. This page specifies intended behavior. Delivery and validation are tracked in the implementation plan; it is not a claim that the platform is already implemented.

Public edge

For the managed v1, Cloudflare can provide:

DNS
TLS
DDoS protection
Outer edge proxy
Origin shielding
Tunnel or authenticated origin connectivity

intrnl remains authoritative for organization identity, app policy, capabilities, and WAF-lite decisions.

The origin should not be directly reachable outside the approved edge path.

Trusted client IP

The gateway trusts client-IP information only when:

The request arrived through an authenticated/allowlisted edge connection.
The edge header is stripped from public inbound traffic.
The proxy chain is explicitly configured.

Never evaluate an IP allowlist against an arbitrary user-controlled X-Forwarded-For.

Egress proxy

All application outbound HTTP/HTTPS traffic passes through an intrnl egress proxy.

Default denials include:

127.0.0.0/8
::1/128
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
link-local ranges
cloud metadata endpoints
cluster service networks
control-plane addresses
runtime management endpoints
internal DNS zones

The proxy must defend against:

DNS rebinding
Redirects from public to private addresses
IP-literal bypasses
Alternate encodings
IPv4-mapped IPv6
Host-header mismatches
Excessive response sizes
Long-running connections

For each connection:

Parse and normalize destination.
Resolve through trusted DNS.
Reject prohibited addresses.
Connect to the approved resolved address.
Verify TLS hostname.
Revalidate each redirect.
Apply method/path/size/rate policy.

Egress capability modes

None
Approved hostname list
Approved integration bindings
General public HTTPS with approval
Private customer integration — future

The organization pilot should default to approved hostnames only, not unrestricted public egress.

No raw TCP

Raw TCP, UDP, SSH, database sockets, and arbitrary private-network connections are outside v1.

Future private integrations should be modeled as bindings or a customer-network connector, not as ambient LAN access.

Domains and TLS

Separate browser site boundaries for applications and the control plane, with wildcard TLS requirements.

Access policies and WAF-lite