Cloudflare Ohttp Gateway

Cloudflare announced an OHTTP Gateway that implements Oblivious HTTP (OHTTP), a privacy-preserving protocol that separates who knows the client’s IP from who sees the request contents. The gateway functions as an oblivious relay: it accepts encrypted requests from clients, forwards them to origin services without learning request payloads, and returns encrypted responses so intermediaries cannot link requests to clients. The write-up explains how deploying such gateways reduces tracking and metadata leakage for use cases like private DNS resolution, privacy-focused APIs, and other services that want stronger client anonymity without changing backend application logic.

The announcement outlines architectural choices, operator responsibilities, and compatibility with existing standards and Cloudflare services, including integration points for developers and deployment options across Cloudflare’s network. It highlights implementation details for performance and security trade-offs - latency introduced by relays versus privacy gains - plus operational considerations such as key management, scalability, and threat modeling. Practical guidance and tooling are provided to help engineers run or integrate with OHTTP relays, with an explicit push toward wider adoption of the IETF standard to improve privacy across web and networked services.