Cloudflare OHTTP gateway

Today, end users transport too much of the burden of online privacy. To evade third-party trackers or targeted ads, users are instructed to use a VPN, disable cookies, or instal adblockers. Meanwhile, several app developers end up knowing additional concerning their users than they’d attention to: a representative client-server toggle creates a trail of person data, akin the client’s IP address or TLS fingerprint. This flat of visibility can be a burden.

That’s why Cloudflare builds infrastructure that helps developers roast privacy into their apps. Oblivious HTTP (OHTTP) is an IETF standard designed to allow app backends to obtain HTTP requests without seeing person IP addresses.

This fall, we’re launching the Cloudflare OHTTP Gateway. Customers volition be capable to allow our new OHTTP Gateway as a paid add-on to their area and commencement receiving OHTTP traffic alongside fair a few clicks. Register through our form to associate our waitlist. Read on to study more.

Expanding our OHTTP merchandise suite

With OHTTP, requests journey through two independently-operated hops: a relay and a gateway. An OHTTP relay blindly forwards encrypted requests in command to conceal client identifiers from app servers. An OHTTP gateway performs the cryptographic activity of decapsulating encrypted requests and encapsulating responses specified that app servers can grip OHTTP requests as if they were plain HTTP. The separation of rely between relay and gateway is critical: it ensures that no sole gathering sees the two client identifiers and petition contents.

In 2022, we launched an OHTTP relay product, Privacy Gateway. Privacy Gateway enables our customers to recommendation additional privacy-preserving experiences to their users. For example, Flo Health uses OHTTP for their app’s Anonymous Mode, and Apple’s Private Cloud Compute uses OHTTP to disassociate AI conclusion requests from person identities. But customers who are already protecting their servers rearward Cloudflare can’t additionally use a Cloudflare-operated relay — they need an OHTTP gateway instead.

In our cognition operating OHTTP relays, we’ve seen how difficult it can be to build and run a secure, performant OHTTP gateway at scale. Today, we’re launching the closed beta for our self-serve Cloudflare OHTTP Gateway. We’re additionally renaming our “Privacy Gateway” to “Cloudflare OHTTP Relay” to improved differentiate the two products. 

Now, customers who desire an OHTTP architecture alongside the necessary separation of rely have two options:

1. Use Cloudflare’s OHTTP Relay (formerly Cloudflare Privacy Gateway) and run your gateway yourself. This is finest if your use servers are hosted off Cloudflare, and you’re capable to run your own OHTTP gateway.
2. Use Cloudflare’s new OHTTP Gateway alongside a third-party relay. This is finest if your app servers are already rearward Cloudflare (on our CDN or Workers, for example), if you’re accepting OHTTP requests from a third gathering (like Apple’s LiveCallerID), or if you desire a managed gateway to minimize latency and operational overhead.  

We’re operating to lift the bar for privacy throughout the Internet, and we accept that protocols akin OHTTP can assistance — if we create them uncomplicated adequate to adopt. It’s continually been our goal to develop our OHTTP merchandise suite and create our trusted privacy infrastructure accessible to a broader swath of the Internet.

Why we built the Cloudflare OHTTP Gateway

Since we launched our OHTTP Relay product, we’ve observed a few things.

First, we’ve seen that there's a expanding appetite among developers for accessible, usable privacy infrastructure. Developers of privacy-oriented apps desire to roast network privacy into their applications by default, but doing so remains harder than it should be.  

Second, we’ve learned that construction and functioning an OHTTP gateway can be durable for customers. Any proxying architecture introduces several latency since requests must journey an additional hop or two about the Internet. Combine that alongside the disbursal to decrypt requests and encrypt responses, and the latency hit of a homegrown OHTTP setup can be significant. We’re well-positioned to resolve this problem: the identical construction blocks that allow us to run fast, dependable privacy infrastructure for products akin 1.1.1.1 and iCloud Private Relay make us a fine residence for an OHTTP gateway. Because of Cloudflare’s anycast approach, our OHTTP Gateway volition run on all server on Cloudflare’s earth border network, minimizing latency in relay-to-gateway hops. If you use our CDN, person requests can be decrypted by our Gateway and resolved by your app servers on the identical Cloudflare metals, preservation gateway-to-origin latency.

Finally, recall that OHTTP’s privacy model requires that the relay and app server be operated by separate, non-colluding parties. We desire to provision our customers alongside the finest imaginable range of options for their privacy infrastructure. Before, developers who protected their app servers rearward Cloudflare weren’t capable to use our OHTTP Relay, since Cloudflare would see the two client metadata and the decrypted contents of requests, breaking OHTTP’s privacy model. Now, developers can choose whether a Cloudflare OHTTP Relay or Gateway is a improved fit for their architecture.

A primer on OHTTP

A representative communication between a client and use server reveals data concerning the client. When a client and app server conversation to one another, the app server learns the client’s IP location since all packet in which data is sent is tagged alongside a origin IP — akin to the “from” tag on an envelope. App servers can additionally “fingerprint” a client according to attributes akin supported TLS versions or code suites. These signals create it imaginable for app servers to nexus multiple requests rear to the identical user.

But what if I wanted to build an app that really doesn’t cognize much concerning my users? For example: Flo Health wanted to build an Anonymous Mode to allow users to admission individual health data without it being linkable to imaginable person identifiers.  

OHTTP introduces a proxy, called a “relay,” that forwards requests and responses between client and app server to obfuscate the client’s character from the app server. The relay sees client identifiers akin IP location and TLS fingerprint, but strips them before forwarding on requests. This prevents app servers from linking multiple requests rear to the identical user, and method that petition contents can’t be connected alongside the user’s IP address.

For example, a regular client-server toggle power disclose the following data concerning a client:

- ipAddress: 192.0.2.33 # the client’s IP location  - ASN: 7922 - tlsCipher: AEAD-CHACHA20-POLY1305-SHA256 # possibly unique - tlsVersion: TLSv1.3 - Country: US - Region: California # the client's location - City: Campbell

A petition archetypal sent through an OHTTP relay would disclose lone the relay’s data to the app server receiving the request:

- ipAddress: 128.62.37.13 # the relay's IP location & fingerprint  - ASN: 18  - tlsCipher: AEAD-AES-128-GCM-SHA256  - tlsVersion: TLSv1.3  - Country: US - Region: Texas # the relay's location - City: Austin

This method that for all request, the app server doesn’t study the location and TLS fingerprint of the end user. Plus, if many distinct users are sending requests through the relay, the app server won’t be capable to differentiate which requests are coming from whom, limiting their capability to trace app action rear to a sole end user. This creates a powerful privacy boundary.

What really differentiates OHTTP from a essential forwarding proxy, however, is the encryption of data between client and app server. Requests and responses are encapsulated using Hybrid Public Key Encryption (HPKE) such that lone the client and app server can see plaintext, and the relay sees lone a jumble of ciphertext. A “gateway” sits between the relay and app server to grip all of this cryptography — decapsulating requests, encapsulating responses — and the app server handles lone plain HTTP.  

This creates a “double-blind” privacy model: the relay sees lone client identifiers; the gateway and app server see lone petition contents; no gathering sees both.

How we built the OHTTP Gateway

In construction our OHTTP gateway-as-a-service, our goal is to bring our secure, performant privacy infrastructure to a broader swath of the Internet. Performance and uncomplicated onboarding are critical. So, we built our Gateway as a elastic assistance deployed throughout our earth network. With fair a brace of clicks, you can allow the Gateway on your area and commencement sending OHTTP to https://your-zone.com/.well-known/ohttp-gateway. We’ll measure the assistance up and downward automatically, so you don’t need to concern concerning capacity.

We had a few another person needs in mind, informed by the ache points we’d seen OHTTP Relay customers run into whenever functioning their own OHTTP gateways.

First: We wanted to theoretical distant as much of the complexity of OHTTP as imaginable for your app servers. We wanted developers to be capable to commencement receiving OHTTP during continuing to obtain regular HTTP traffic if they chose. So, we designed the Gateway as a characteristic of your zone, anywhere clients dispatch well-formatted OHTTP requests to a /.well-known/ohttp-gateway endpoint on your zone. We assistance the two norm and chunked OHTTP — and we propose using chunked OHTTP for improved performance, since it enables us to procedure requests incrementally (in “chunks”).

Our Gateway assistance volition obstruct all request, decrypt it, matter a subrequest to your app server, and come back an encrypted reply to the client. All non-OHTTP requests volition journey to your server without invoking the Gateway.

Binding your Gateway to your area additionally enables us to defend your Gateway from abuse. A client sending requests to your area `example.com` may dispatch to `foo.example.com` or `bar.example.com`, but not wikipedia.com. Without you needing to concern concerning it, this prevents unauthorized clients from using your area as a way to mark another domains.

Second: Seamless key administration is critical. Gateways need to keep a community HPKE key configuration to allow clients to encrypt requests, but managing keys securely is a challenge. So, we designed the Gateway to completely oversee all keys for customers, and to assist community keys as responses to GET requests to  /.well-known/ohttp-gateway. For stronger privacy, clients can download keys complete a distinct IP than they petition the gateway.

Third: Gateways need to be capable to authenticate relays. Because the Gateway (by design) knows extremely small concerning the client sending a stated request, it places rely in the relay to authenticate clients and onward traffic responsibly. But how do you justify that lone trusted relays can dispatch traffic to your gateway?

We designed the Gateway specified that Cloudflare Access, Cloudflare’s zero rely network admission product, runs before requests are decrypted, enabling you to use any norm Access policies to authenticate incoming traffic and defend your Gateway from abuse. Options contain mutual TLS, fixed assistance credentials, and tradition external logic.

Finally: Mistakes happen, and we anticipated that customers power accidentally interrupt OHTTP’s privacy example by operating the two their relay and gateway on Cloudflare. So, to maintain OHTTP’s separation of rely and justify that Cloudflare never sees both client identities and decrypted inner requests, our Gateway volition refuse to decrypt requests sent from Cloudflare Workers or from proxied hosts on Cloudflare.

When is the OHTTP Gateway a improved fit than the OHTTP Relay?

If you desire to use Cloudflare’s OHTTP merchandise suite, but you’re wondering why you’d choice Cloudflare’s OHTTP Gateway alternatively of the OHTTP Relay, current are a brace of considerations.

First, do you desire your app servers on Cloudflare – rearward our CDN or built on Workers, for example? If so, the OHTTP Gateway is a improved fit to justify adherence to OHTTP’s privacy model.

Second, what’s your use case? If you desire to obtain OHTTP requests from a third-party client and relay — to use Apple’s LiveCallerID SDK, for example — afterward the OHTTP Gateway is apt the improved resolution for you.  

Getting started

If you have a characteristic petition or would akin to enroll for our waitlist, so we can notify you whenever the merchandise launches, sign up here.

Then, you’ll need to execute an OHTTP client. See ohttp.info or our sample client library for several examples to assistance you get started. One emblem as you build the client: OHTTP provides privacy at the network level, and doesn’t contact the inner petition body. So, to maintain person privacy, it’s up to you not to dispatch identifying data (e.g. a user’s email location or username) in the petition body.

Next, you’ll need to bring your own relay. Relays can run on any infrastructure provider, and they’re simple: here’s several sample code. The difficulty and the logic you power desire a dedicated OHTTP relay provider, is to verifiably commitment to your users that you won’t inspect logs alongside client identifiers. Otherwise, you’d be capable to correlate clients at the relay alongside decrypted requests at your app servers.