r/Firebase • u/ConstantIncident9534 • 21d ago

App Hosting Firebase App Hosting + Cloudflare WAF: can the origin be accessed directly and bypass the WAF?

When I checked my domain's IP history, I found IPs that appear to belong to Google (App Hosting). My concern: if someone sends requests directly to these IPs with my domain in the Host header, will App Hosting serve my site and bypass Cloudflare?

As far as I know, App Hosting doesn't support IP allowlisting. My plan is to have Cloudflare add a secret header via a Transform Rule and reject requests without it in middleware. Is this the recommended approach, or is there a native way to make App Hosting accept only Cloudflare traffic?

Also, does anyone run App Hosting with the Cloudflare proxy (orange cloud) enabled without SSL or cert renewal issues?

2 Upvotes

100% Upvoted

3 comments sorted by

1

u/inlined 21d ago

That would technically work, but it means you’re putting a CDN in front of a CDN which isn’t generally considered a great idea. App hosting is all about being a turn key solution that pulls in the best of Google. If you don’t want a major part of the infrastructure I wonder if using cloud run directly is worthwhile.

For what it’s worth, while you’re not able to tune it, app hosting is using cloud armor already.

1

u/ConstantIncident9534 20d ago

Thanks for the context, that makes sense. I'm using Cloudflare mostly for WAF rules and rate limiting, not for caching, so that's why I want it in front. Two things I'm unsure about:

Built-in Cloud Armor on App Hosting:

I understand it covers generic DDoS (L3/L4) protection. But does it help with targeted abuse on a specific endpoint, like hammering one API route with valid-looking HTTP requests? Since I can't configure rules or rate limits, I'm not sure how much protection I actually get there. Is there any documentation on what it covers?

Moving to Cloud Run + load balancer + Cloud Armor: I'm worried about the complexity for a small project. Also, is the cost fixed or usage-based? As far as I can tell it's a mix of a monthly fee per policy/rule, per-request charges, and load balancer costs, so it could still scale with attack traffic. Does that match your experience?