Cloudflare is changing text in the page (+ display html as plain text)

So i have setup a traefik middleware for my error pages and when the error page is though Cloudflare it just display the page as plain text.

I did a compare on both CF proxied and not proxied, and some text where changed inside the response body.

Ibaraki DoujiOP•8/14/24, 2:26 PM

left is non proxy,
right is proxied

Ibaraki DoujiOP•8/14/24, 2:27 PM

also to test i disabled the cache but no

Ibaraki DoujiOP•8/14/24, 3:27 PM

adding a html response header fix the problem

Ibaraki DoujiOP•8/14/24, 3:29 PM

but WHY does this happen ?
and is there something else than editing the CF response headers ?

Ibaraki DoujiOP•8/14/24, 3:50 PM

(also if you ask, no in the non-proxied page i don't have any content-type and it works)

Ibaraki DoujiOP•8/14/24, 3:54 PM

looking for more elements your x-content-type-optionsx-content-type-options header is the cause

Ibaraki DoujiOP•8/14/24, 3:54 PM

is there a way to remove it (other than rules) ?

Ibaraki DoujiOP•8/14/24, 3:55 PM

if no i will stick on rules but if there is an option to remove it globally that would be perfect

IIbaraki Douji looking for more elements your `x-content-type-options` header is the cause

Chaika•8/14/24, 3:58 PM

oh so you're not returning the content-type and you have nosniff set

Chaika•8/14/24, 3:58 PM

that header isn't on by default, you enabled something to add it

Chaika•8/14/24, 3:59 PM

Enabling the Managed Transform Add Security Headers (Rules -> Transform Rules -> Managed Transform -> Add Security Headers) would add it, for example

CChaika Enabling the Managed Transform Add Security Headers (Rules -> Transform Rules ->...

Ibaraki DoujiOP•8/14/24, 4:04 PM

this is disabled (everything in managed is disabled)

Ibaraki DoujiOP•8/14/24, 4:04 PM

maybe in other security things

Ibaraki DoujiOP•8/14/24, 4:04 PM

Security > Settings

Chaika•8/14/24, 4:06 PM

You could throw the url through trace under account https://dash.cloudflare.com/?to=/:account/trace/search and see all it hits

Ibaraki DoujiOP•8/14/24, 4:07 PM

oh that a cool thing, let me try it

Ibaraki DoujiOP•8/14/24, 4:09 PM

on what i see it hits the default ruleset and my test rule
(for the cache i'm in dev mode so it should not count)

Chaika•8/14/24, 4:10 PM

you don't see this response header being returned from your origin at all?

CChaika you don't see this response header being returned from your origin at all?

Ibaraki DoujiOP•8/14/24, 4:12 PM

on the trace page no

Ibaraki DoujiOP•8/14/24, 4:13 PM

i just see the response code (200)

Chaika•8/14/24, 4:13 PM

yea it doesn't show you headers/make an origin request

Chaika•8/14/24, 4:13 PM

I mean if you bypass the proxy and see the request headers

Ibaraki DoujiOP•8/14/24, 4:13 PM

when i bypass this is the response headers

Ibaraki DoujiOP•8/14/24, 4:14 PM

and request headers (i just hidded the :authority::authority:)

IIbaraki Douji when i bypass this is the response headers

Ibaraki DoujiOP•8/14/24, 4:15 PM

and if you want proxied response headers here you go

Cloudflare is changing text in the page (+ display html as plain text)

Similar Threads

Similar Threads

Similar Threads