Cloudflare, Inc.

David Alexander Kitchen

Andrew Galloni

Julien Desgats

Ben Cartwright-Cox

Sam Howson

Benedikt Christoph Wolters

Alex Cruz Farmer

An edge server receives a request from a client device for an action to be performed on a resource. The edge server determines whether data traffic is associated with one or more filters. When the edge server determines that there are filters associated with the type of data traffic, the edge server accesses a data structure storing properties of the request. For each request property in the data structure, the edge server applies a related filter to a value of the request property and determines where the value of the request property matches an expected value. In response to determining that one or more filters match, the edge server performs actions on the request. When the edge server performs the actions on the request, the edge server sends the request to the origin server.

Applying filter expressions to requests at an edge server

An edge server receives a request from a client device to access a resource. The edge server determines whether the requested resource includes a tag within the code of the resource. When the edge server determines there is the tag in the resource, the edge server generates a token, associates the token with the resource (e.g., inserts the token in the code of the resource), and sends the resource to the requesting client device. In response to subsequent requests from the client device for actions to be performed with respect to the resource, the edge server determines whether the action requires a token. When the requested action requires the token, the edge server extracts the token in the request and processes the request after validating the token.

Providing cross site request forgery protection at an edge server

A compute server receives a request from a client device, where the plurality of compute servers are part of a distributed cloud computing platform, and wherein the request is a request for a network resource. The compute server executes, by a single process at the first compute server, a response inspector, wherein the response inspector is run in a one of a plurality of isolated execution environments. The compute server receives at least one content item from an origin server in response to the request for the network resource. The compute server detects a protected content marker in the at least one content item that indicates a data breach, and logs information about the request in an inspection log.

Transparent inspection of responses from origin servers to identify protected data

A method and an apparatus of limiting a rate at which traffic is received at an origin server are described. A first request for a resource at an origin server is received at a proxy server from a client device. A first response that includes a refresh instruction, a first refresh time, and a first cryptographic token that is not valid until a first predetermined time is reached is transmitted to the client device. The refresh instruction is to cause the client device to request the resource after the first refresh time has elapsed. As a result of the refresh instruction a second request for the resource is received from the client device. The second request includes the first cryptographic token. Responsive to determining that the first cryptographic token is valid, fulfilling the request.

Method and apparatus for limiting traffic rate to an origin server

A method and an apparatus of limiting a rate at which traffic is received at an origin server are described. A first request for a resource at an origin server is received at a proxy server from a client device. A first response that includes a refresh instruction, a first refresh time, and a first cryptographic token that is not valid until a first predetermined time is reached is transmitted to the client device. The refresh instruction is to cause the client device to request the resource after the first refresh time has elapsed. A value of a first counter is incremented. As a result of the refresh instruction a second request for the resource is received from the client device. The second request includes the first cryptographic token. Responsive to determining that the first cryptographic token is valid, fulfilling the request.

A method for providing a desired portion of a data object document is disclosed. The method comprises receiving, from a client device, an Application Program Interface (API) request for a data object document, where the API request includes a parameter identifying the desired portion of the data object document, and the desired portion is less than all of the data object document. The method continues with transmitting the API request for the data object document to an origin server, and receiving an API response from the origin server that includes the data object document including more than the desired portion of the data object document. The method further includes automatically selecting, from the received data object document, the desired portion of the data object document based on the parameter, and transmitting, to the client device, the desired portion instead of all of the data object document.

Growing community of inventors

London, United Kingdom

David Alexander Kitchen