News
Alt-Svc vs Origin IP Exposure on CDNs
February 21, 2022
Alt-Svc vs origin IP exposure on CDNs is a performance header versus a bypass map. Alt-Svc (RFC 7838) tells supporting browsers they may use another protocol or host for this origin — commonly h3=":443" for HTTP/3 on the same name. That is not a security control. Putting a raw origin IP, a staging hostname, or a non-CDN VIP in Alt-Svc is how you invite clients around the WAF. Server banners and CDN fingerprints are a different disclosure class. RoastMyOpsec inspects public landing headers for banners and does not score Alt-Svc, does not speak HTTP/3 as a finding, and does not probe origin IPs.
The practical difference
Same-host h3 on 443 is a protocol upgrade. A different host in Alt-Svc is a new name you must TLS-authenticate as this origin (the spec is strict). An IP in the advertisement is an inventory gift. Keep origin IPs off DNS, off error pages, and off Alt-Svc.
www vs apex still needs one canonical host. Alt-Svc should not resurrect the loser hostname as a secret HTTP/3 endpoint.
How to choose an Alt-Svc
If the CDN terminates HTTP/3 on the same public name, a boring h3=":443" (with a sane ma=) is fine. If you do not offer HTTP/3, omit the header. Do not advertise a second company domain you do not control. Do not copy an origin's Alt-Svc through the CDN unchanged if the origin named an internal host.
| Advertisement | Typical intent | OPSEC risk | Takeaway |
|---|---|---|---|
| h3=":443" same host | HTTP/3 on the edge name | Low if the name is the public CDN | Performance; not a WAF |
| Alt-Svc to an origin IP | Usually a misconfig | Bypass map | Remove it |
| Alt-Svc to staging.example | Wrong environment | Inventory + weaker auth | Keep env split |
| Server / via / cf-ray | CDN fingerprint | Stack hint, not an IP | See CDN vs origin guide |
What the roast can prove
Banner and CDN-shaped headers on the HTML response can surface. Alt-Svc is not scored. Confirm the header in your CDN dashboard. Pair with dangling CNAMEs if a leftover name still resolves.
Common mistakes
The first mistake is origin Alt-Svc leaking through to the browser.
The second mistake is advertising HTTP/3 on a host whose cert SAN does not match.
The third mistake is treating missing Alt-Svc as an OPSEC F.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is Alt-Svc a security header?
- No. It advertises alternative services. Keep it on your public CDN name only.
- Should every site enable HTTP/3 Alt-Svc?
- Only if the edge actually speaks it. Missing Alt-Svc is not a roast finding.
- Does RoastMyOpsec score Alt-Svc?
- No. It does not treat HTTP/3 as a vulnerability and does not probe origin IPs.