How Cloudflare verifies the code WhatsApp Web serves to users
Mar 10, 2022Matt Silverlock, James Allworth, Mari Galicer
Summary
Introduced a system where Cloudflare acts as a trusted third-party auditor for code integrity. This involves storing hashes of intended code (e.g., WhatsApp Web JavaScript libraries) and providing an audit endpoint for a browser extension (Code Verify) to compare against the locally computed hash of the executing code. This system automates the verification process, making it accessible at scale and enhancing user assurance against code tampering.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack