Gergely Kis
33
Hi,
Love the latest blog post: https://www.frameworkm.dev/blog/application-layer-payload-encryption
Does this mean that one can deliver the frontend assets and an API proxy (with DDOS protection) on a public edge platform like CloudFlare, but all the private information is end-to-end encrypted from the browser / mobile app directly to the upstream servers (which don't need to have direct internet facing attack surface)?
Kind regards,
Gergely
That’s exactly the intended setup.
You can safely keep Cloudflare (or any edge WAF/CDN) out front for DDoS mitigation, bot handling, and asset delivery. Because the payloads are encrypted as JWE envelopes (Content-Type: application/jose) directly in the browser or mobile app, the edge layer only ever sees ciphertext, NO plain-text PII or credentials can leak into edge logs or WAF memory.
Your upstream backend can sit completely private inside an isolated VPC or behind a private tunnel, decrypting the payload only when it hits the Framework M middleware.
Just remember that headers and URL paths are still visible to the proxy for routing, so keep sensitive values strictly inside the request body!
