Cloudflare’s OHTTP Gateway Refuses to Decrypt Requests That Arrive Through Cloudflare

Cloudflare has opened a closed beta of its OHTTP Gateway, a managed endpoint that decrypts Oblivious HTTP requests for an origin. The design choice drawing attention is a refusal: the Gateway will not decrypt requests arriving from Cloudflare Workers or from hosts proxied through Cloudflare, because that would put client identifiers and request contents in the same hands.

By Steef-Jan Wiggers