Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Is there a Cloudflare setting that corresponds to the creation of the __cfduid session cookie?

I'm currently trying out CF; mostly for the neat DNS management and the implicit CDN. But the basic WAF is possibly just as nice an addition atop Apaches mod_security/CRS. However I'm not sure what said cookies purpose is, and would prefer to get rid of that.

The most obvious setting

Security profile: Essentially off

Seems to also have essentially no effect on the creation of __cfduid with every HTTP response. The cookies purpose is presumably for opting out single users from firewall rules, repeated cloudflare captchas, etc.

Their support documentation alludes to that. Where the first revision from 09/2012 (https://support.cloudflare.com/hc/en-us/articles/200169536-What-does-the-cfduid-cookie-do-) says this behaviour can't ever be turned off. An entry two months later 11/2012 (https://support.cloudflare.com/hc/en-us/articles/200170156-What-does-the-CloudFlare-cfduid-cookie-do-) however omits that note.

While Cloudflares TOS itself check out as plausible, this cookie has all the properties of a tracking session, dc41f5a78bc3e27d44b70fca4606e4262283407700773. The excessive cookie lifetime of 6 years is very odd for the exemplary internet cafe visitor use case. And since I'm personally avoiding needless sessions, and don't want to plaster a privacy note (in light of the infamous EU cookie law) like everyone else, I'd prefer to have it gone per default.

A workaround like:

  Header add Set-Cookie "__cfduid= ; path=/; domain=.example.org; HttpOnly"

Does eschew its storage, but retains two needless headers, and doesn't seem overly reliable.

So, is there another CF setting for this?

share|improve this question

1 Answer 1

No, there is no way to turn the cookie off if we are proxying the record (if you had a subdomain not running through our proxy in your DNS settings, then we wouldn't add the cookie because it is going direct to your server). The cookie is basically what makes security (like a challenge page) work.

share|improve this answer
2  
"Makes security work" is still vastly indescriptive. How does it aid security against e.g. bots which aren't typically sending session cookies along? If it's just for CAPTCHAS then what's the excessive cookie expiry time for? –  mario Mar 18 '14 at 18:27
    
I suspect it's for establishing who is trusted, not who isn't trusted. If you don't have the session cookie, you are in the state of least trust. If you have the session cookie, you can be untrusted or trusted or anywhere in between. Thus, not sending the session cookie means you'll be treated in a more hostile manner by the WAF, not less. It would then follow that it has an 'excessive' cookie expiry time to stop you being needlessly pestered or throttled in future. –  Rushyo Apr 9 at 15:34
    
Turns out cloudflare hosts a lot stuff i often browse (api documentation, open source projects), which are all useless to me right now. No. I'm not going to enable random session cookie injection on domains that have nothing with cloudflare to do (like jqueryui.com, expressjs.com). __cfduid breaks internet standards. It's wrong. –  Martin Algesten Apr 28 at 13:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.