01 / ORIGIN
Azure App Service
Python echoes every received request header. In the conventional HTTPS phase, Azure terminates TLS with your managed certificate.
02 / CONNECTIVITY
Cloudflare Tunnel
A cloudflared sidecar can reach the Python process over localhost. The final tunnel-only setup disables ordinary public ingress.
03 / IDENTITY
Access, Worker, R2
The separate Worker validates identity before returning HTML or reading a flag from private R2 storage.
Demo warning: all headers are echoed, including cookies and authorization values. Use synthetic credentials on a dedicated lab domain. Do not share captured session headers.
Ready.
The response will appear here.
Verify, don't assume
- Check the origin response and Cloudflare-added headers.
- Prove the managed certificate/SNI binding and Full (strict) in the conventional proxy phase.
- Test rate limiting, the tunnel and denied direct access.
- Sign in to /secure and follow the country link after deploying the separate Worker.
This page describes intended architecture. It does not automatically audit Azure or Cloudflare settings.