Weird bug of the day: Twitter in-app browser can't visit site
Sep 8, 2015John Graham-Cumming
Summary
This post details the debugging and resolution of an issue where the Twitter in-app browser failed to load Cloudflare-protected sites when transitioning from an HTTPS link in a tweet to an HTTP link on a Cloudflare customer's site. The root cause was identified as the Twitter app blanking out the Referer header, which violated RFC 7231. Cloudflare's Browser Integrity Check was flagging this as an error. The fix involved relaxing the Referer header check for this specific client behavior, demonstrating an adaptation of security policies to accommodate real-world client quirks while adhering to Postel's Law.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack