Web Security Fundamentals
Web Security Fundamentals covers the plumbing the rest of the exam assumes: how HTTP requests traverse Cloudflare's reverse proxy, how TLS is terminated and re-established to the origin, and which protections are enforced by browsers rather than by the edge. Questions here test whether you can predict the effect of a configuration change before you make it.
The request path
Cloudflare acts as a reverse proxy. When a DNS record is proxied (orange cloud), the client resolves Cloudflare anycast addresses, completes TLS with the nearest data center, and Cloudflare opens a separate connection to your origin. Two independent TLS sessions exist. That single fact explains many exam scenarios: a fix applied at the edge does not automatically fix an origin-side problem.
SSL/TLS modes
- Off – no encryption; unsuitable outside testing.
- Flexible – HTTPS to Cloudflare, HTTP to origin. The origin leg is plaintext, and redirect loops are common if the origin forces HTTPS.
- Full – HTTPS to origin, but the origin certificate is not validated, so self-signed certificates are accepted.
- Full (strict) – HTTPS with validation against a trusted CA or a Cloudflare Origin CA certificate. This is the correct default.
- Strict (SSL Only) – as Full (strict), but also forces a valid certificate on every request.
Pair strict modes with Authenticated Origin Pulls so the origin only accepts connections presenting Cloudflare's client certificate, and with Always Use HTTPS plus HSTS to prevent downgrade and cookie leakage.
Browser-enforced controls
The same-origin policy, CORS, and cookie attributes (Secure, HttpOnly, SameSite) are enforced by the browser, not the edge. Cloudflare can rewrite headers but does not 'handle CORS for you'. Likewise, XSS, CSRF, SSRF, and broken access control must be fixed in the application; the WAF reduces exposure but is not a substitute.
Worked example
A visitor reports Error 526: Invalid SSL certificate. Reasoning: 526 appears only in Full (strict) or Strict modes, when the origin certificate is expired, self-signed, or issued for a different hostname. Flexible would not produce it. The fix is to install a Cloudflare Origin CA certificate on the origin or correct the hostname mismatch - not to downgrade to Full, which silently removes validation.
Traps
- Confusing 522 (connection timed out) with 526 (certificate rejected).
- Assuming the orange cloud hides every origin IP; grey-clouded records, historical DNS, and outbound traffic can still leak it.
- Treating HSTS preload as reversible - removal from browser lists takes months.
- Believing Flexible mode is secure because the browser shows a padlock.