Diffbrief Engineering daily

← Saturday, October 3, 2026Cloud & infraRelease

Cloudflare adds an OHTTP gateway to hide client IPs from app backends

blog.cloudflare.com 10 min read Editor score 6/10

OHTTP sends requests through a relay and gateway so app backends do not see client IP addresses; Cloudflare is offering a managed gateway as a paid add-on. Engineers designing privacy-sensitive services can assess a concrete deployment option.

What
Cloudflare's OHTTP Gateway is a managed gateway option for applications that use Oblivious HTTP to hide client IP addresses from app backends.
How
An OHTTP relay forwards encrypted requests; the gateway decapsulates them for app servers and encapsulates responses, separating trust between relay and gateway.
Why it matters
The split lets engineers add privacy without any single party seeing both client identifiers and request contents.
encrypted req… HTTP request response encapsulated response relay gateway app servers
The diagram shows OHTTP requests and responses passing between relay, gateway, and app servers. Sketched from the article's own text.

Read on blog.cloudflare.com → Hacker News · 10 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.

Your note

Private to you. Stored in this browser, and synced to your account when you are signed in.