#cloudfront

1. 
   aws

   Closing the Rate-Limit Bypass: A CloudFront + ALB Case Study

   How we closed an `X-Forwarded-For` spoofing bypass on an AWS WAF rate-limit rule — CloudFront custom secret header, ALB origin verification, and a composite-key rate-based rule that actually counts real clients.

   NH Nedim Hadzimahmutovic Sep 14, 2026 · 10 min
2. 
   aws

   How a CloudFront Custom Error Page Leaked JWTs to S3: A Case Study

   A pen-test curl found CloudFront forwarding `Authorization` headers to the S3 error-page bucket, where S3 reflected every JWT back in its XML error response. Two lines of Terraform closed it across sixteen distributions.

   NH Nedim Hadzimahmutovic Aug 13, 2026 · 12 min

No essays match that search.