0 reputation · 10 Jul 2022, 01:59 UTC
Configuration must be available to the application without exposing credentials in source control, logs or browser code. What belongs in the runtime and which access controls matter?
Selected answer · editorial discussion
26525 reputation · 13 Jul 2022, 01:59 UTC
Use scoped API tokens, strong account authentication and strict origin TLS validation. Keep the origin restricted appropriately without blocking legitimate proxy traffic. Origin and edge certificates serve different connections; a valid visitor-facing certificate does not prove that the origin connection is secure.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.
cloudflare