To deploy Oblivious HTTP (OHTTP), you need three cooperating components: a client, a relay, and a gateway. The client encodes an inner HTTP request as Binary HTTP and encrypts it with HPKE for the gateway. The relay forwards that ciphertext without reading the request. The gateway decrypts, authorizes and processes the inner request, then encrypts the response back through the relay.
This separation can hide a client’s network identity from the application gateway, but it is not a universal privacy layer for ordinary stateful websites. The relay and gateway should have separate operators, both network legs must use HTTPS, and the gateway must restrict which targets it can contact. The procedure below follows RFC 9458, with service discovery details from RFC 9540.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
WatchGuard Firebox M295 High Availability Unit with 3 Year Standard Support - HA Device for... | $2,185.11 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
What an OHTTP deployment contains
RFC 9458 describes OHTTP as “a protocol for forwarding encrypted HTTP messages.” Its privacy property comes from dividing knowledge between two intermediaries rather than from encryption alone.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Component | What it does | What it should not learn or do |
|---|---|---|
| Client | Builds the inner request, serializes it as Binary HTTP, encrypts it with the gateway’s HPKE key configuration, sends it to the relay, and decrypts the returned response. | It cannot assume that OHTTP authenticates the target resource. The client needs a separate way to authorize the gateway for that target. |
| Relay | Accepts the encapsulated message and forwards it to the configured gateway, then returns the gateway’s encapsulated response. | It should not decrypt the HTTP message, add identifying headers, or operate as an unrestricted proxy. |
| Gateway | Removes HPKE protection, validates and handles the inner request, optionally forwards it to an authorized target, and encapsulates the response. | It must not accept arbitrary destinations or treat user-supplied target URLs as permission to proxy anywhere. |
The RFC model uses a one-to-one relay-to-gateway mapping. A relay is configured for a particular gateway rather than acting as a general-purpose forwarding service. Before a client sends its first request, it needs the relay resource identity, the gateway resource identity, and an authenticated gateway key configuration containing the public-key identifier and supported algorithms.
#1 Best Overall
- High Availability (HA) redundant unit for resilient failover and uptime. Operates only as the secondary in an HA pair and must be paired with a primary WatchGuard Firebox of the same model for synchronization and failover. Not a standalone appliance.
- WatchGuard Firebox M295 High Availability Unit with 3 Year Standard Support License (WGM29501603) - The Firebox M295 combines enterprise-grade security with multi-gig connectivity, SD-WAN, TLS decryption, and proxy-based inspection in a compact rackmount design.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and continuity: 4x 2.5Gb RJ45, 4x 1Gb RJ45, 2x 10Gb SFP+ with VLANs and link aggregation, plus RIP, OSPF, BGP, and high availability to keep sites online.
When OHTTP is a good fit—and when it is not
Good use cases
- Stateless or nearly stateless requests where the application can answer each request without a long-lived HTTP session.
- Telemetry, abuse-resistant counters, privacy-sensitive lookups, and other workloads where the application should not directly see the client’s network address.
- Deployments in which an independent relay operator can be trusted not to collude with the gateway operator.
Cases that need another design
- Applications that depend on cookies, bearer credentials, server-side sessions, or a sequence of stateful browser requests.
- Workloads requiring the client to authenticate the target origin directly through the protocol.
- Systems where traffic analysis, request timing, message size, or repeated request content would itself reveal the user.
OHTTP does not remove identifiers deliberately placed in the inner request. Names, email addresses, phone numbers, account IDs, cookies, authorization headers, and distinctive payloads remain visible to the gateway after decryption. Review application logs, analytics, and crash-reporting paths for the same data.
Prepare the threat model and infrastructure
Keep the relay and gateway operationally separate
RFC 9458 relies on separation between relay and gateway operators for its stated privacy goals. If one organization controls both, it can potentially correlate the client address observed by the relay with the decrypted request observed by the gateway. The gateway and the permitted target can be colocated without defeating the client-privacy model, because the important separation is between relay and gateway.
Plan both HTTPS connections
Use HTTPS from client to relay and from relay to gateway. These are protocol requirements, not optional hardening. The first leg prevents a network observer from reading or altering the client-to-relay exchange; the second protects the encapsulated message and its routing between the two intermediaries.
Define the target authorization boundary
Write down every origin, path family, method, and content type the gateway is allowed to serve. Enforce that policy before forwarding an inner request. A gateway that accepts an arbitrary destination supplied by a client has become an open forward proxy, which creates abuse, scanning, and data-exfiltration risks.
How do I set up an OHTTP relay and gateway?
1. Choose or build an RFC 9458 gateway
Select an implementation that supports the RFC message format, Binary HTTP processing, HPKE encryption and decryption, and your application’s request and response semantics. Decide whether the gateway will answer the inner request itself or forward it to a separately protected backend.
The thibmeu/ohttp-gateway repository is a concrete, non-normative implementation example. Its documentation requires an OHTTP_KEY_SEED, exposes GET /.well-known/ohttp-gateway for an application/ohttp-keys response, and documents POST paths for decapsulation and forwarding. Its runtime choices, environment variables, algorithms, and defaults belong to that repository; do not treat them as universal OHTTP settings.
2. Generate and protect gateway key material
Create the HPKE key configuration that clients will use. It must identify the active key and advertise the algorithms needed to encapsulate requests and responses. Store private key material outside source control, restrict access to the gateway process, and protect backups with the same care as any credential.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Publish the corresponding public configuration through an authenticated, integrity-protected channel. RFC 9458 requires the client to be able to attribute the selected configuration to the intended gateway. A TLS connection alone is not a substitute for validating that the key configuration is the gateway’s configuration when a separate distribution mechanism or cache is involved.
3. Deploy the gateway endpoint and policy layer
Expose the gateway resource used for discovery and the endpoint that accepts encapsulated requests. The request handler should:
- Validate the encapsulated message and the key identifier.
- Perform HPKE decapsulation and Binary HTTP parsing.
- Apply method, origin, path, size, and content-type policy.
- Remove or normalize any application headers that are not required.
- Handle the request locally or forward it only to an allowlisted target.
- Encode the response as Binary HTTP and encapsulate it for the client.
Keep malformed-message handling uniform enough that errors do not become a side channel revealing whether a key, target, or user identifier exists.
4. Configure a dedicated relay
Configure the relay with the gateway resource identity and a fixed upstream route. The relay receives the client’s encapsulated body and must forward the bytes without decrypting, rewriting, or reserializing the inner message. It should return the gateway’s encapsulated response as received, subject only to transport-level limits and error handling.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use a privacy-aware intermediary configuration. Strip unknown and identifying fields, and do not add Via, Forwarded, or equivalent headers that expose the client to the gateway. Keep relay logs limited to operational data that cannot be used unnecessarily to reconstruct a user’s activity. A generic HTTP proxy can serve as a relay only after these behaviors are verified.
5. Configure the client
Provide the client with:
- The relay URI it will contact.
- The gateway resource identity associated with that relay.
- An authenticated gateway key configuration, including the key identifier and algorithm parameters.
The client creates the inner HTTP request, serializes it as Binary HTTP, encrypts it with HPKE for the gateway, and sends the resulting encapsulated message in a POST to the relay. The relay forwards it to the gateway. The client then validates and decrypts the encapsulated response and interprets the inner HTTP response according to the application protocol.
Do not put user-identifying data into the inner request unless the gateway genuinely needs it. OHTTP separates network identities; it does not anonymize the application payload.
How gateway discovery and key retrieval work
RFC 9540 defines the ohttp service-binding indication and a default gateway resource at /.well-known/ohttp-gateway. A client can request that resource with an HTTP GET and an Accept: application/ohttp-keys header. A successful response uses the application/ohttp-keys media type.
Validate the resource identity
A gateway may redirect discovery to another resource. The client must not pass a client-specific redirected URI to the relay as the gateway destination. A unique URI can become a fingerprint that lets the relay or gateway distinguish clients. Resolve redirects according to a deployment-wide policy and use a stable gateway identity for relay routing.
Decide how keys are fetched
Fetching the key configuration directly from the gateway can reveal identifiers such as the client’s IP address. An HTTP proxy can hide that address during retrieval. Consistency checks can also help detect a unique or unexpectedly personalized key configuration. Whichever method you choose, verify integrity and authenticity before selecting a key for encryption.
Handle rotation and overlap
Publish a new public configuration before retiring the old private key. Keep the old key available for the overlap period needed for in-flight requests and client caches, then remove it after monitoring confirms that clients have moved to the new identifier. Document cache lifetimes, rollback steps, and how the relay recognizes the stable gateway identity during rotation.
Relay privacy and transport controls
Metadata handling
The relay can see the gateway destination and encrypted message length. It should not learn the plaintext method, path, headers, or body. Remove client-supplied fields that are not needed for transport, reject unexpected hop-by-hop headers, and prevent upstream components from reintroducing address fields.
Logging
Separate security and operations logs from request content. Avoid recording full encapsulated bodies, stable client tokens, or combinations of timestamps and lengths that make correlation easy. If diagnostic sampling is necessary, establish retention limits and access controls before enabling it.
Abuse controls
Apply rate limits, body-size limits, connection limits, and timeout policies at the relay without inspecting the encrypted application payload. Coordinate those limits with the gateway so the relay cannot be used to amplify traffic or keep expensive upstream connections open indefinitely.
Test the complete request and response path
Run tests with a non-sensitive target before introducing production data.
- Fetch the gateway key configuration and verify its media type, key identifier, algorithm parameters, integrity, and authenticated association with the gateway.
- Start the client with the relay identity, gateway identity, and selected key configuration.
- Send a small inner request through the relay and confirm that the gateway receives a valid Binary HTTP message after decapsulation.
- Verify that the gateway can reach only the configured target and rejects an unauthorized destination.
- Confirm that the gateway’s response is encapsulated and can be decrypted by the client.
- Inspect relay traffic and logs to ensure the relay forwards the encapsulated bytes, does not add identifying headers, and cannot read the inner request.
- Exercise malformed ciphertext, unknown key identifiers, oversized bodies, expired keys, redirect responses, and upstream timeouts.
Test both success and failure paths through the same relay and gateway topology that production will use. A direct client-to-gateway test does not validate OHTTP privacy properties.
Recommended Free Tools
Operational choices and trade-offs
| Decision | Self-hosted approach | Managed-relay approach |
|---|---|---|
| Operator separation | You must contract, deploy, and govern an independent relay operator or organization. | The provider operates the relay, but you still need to verify its data handling and contractual separation from your gateway. |
| Key publication | You control discovery, authentication, rotation, caching, and rollback. | You integrate the provider’s relay and key-distribution requirements and remain responsible for gateway key validity. |
| Runtime support | You choose language, hosting, scaling, and observability components. | You accept the provider’s supported protocol behavior, regions, limits, and change schedule. |
| Latency and cost | You pay in engineering effort, operations, and an additional network hop. | You trade infrastructure work for provider dependency, service limits, and potentially less control over placement. |
Cloudflare’s OHTTP Relay documentation, updated October 2, 2026, describes a customer-operated application gateway, client-side support, and a connection to its relay. Cloudflare says the relay sees the server and encrypted message length but not application data. Its overview describes the service as enterprise-only and in closed beta for selected privacy-oriented companies and partners at that date. Availability is volatile, so confirm current eligibility and terms before designing around it.
Security limitations you must document
OHTTP does not authenticate the target to the client
The client does not directly authenticate the target resource through OHTTP. It must have a separate authorization mechanism that establishes which gateway may be used with which target. The gateway can dictate the response returned to the client, so do not treat a successful OHTTP exchange as proof that a named origin generated the content.
Correlation is still possible
Identical or highly distinctive request content can link activity. Active key configurations partition anonymity sets, and traffic analysis based on timing, volume, and message length is outside the protection claimed by RFC 9458. Padding, batching, and application-level aggregation may reduce some signals, but they add complexity and latency and must be designed for the workload.
Relay and gateway collusion defeats the separation
If the two operators share logs or cooperate in real time, the relay’s client identity and the gateway’s decrypted request can be joined. Governance, contractual separation, access controls, and independently managed telemetry are part of the privacy design, not administrative afterthoughts.
Stateful browser behavior remains visible at the application layer
Cookies, login sessions, authorization tokens, and user-specific payloads reintroduce identity after decryption. Remove them, replace them with privacy-preserving tokens, or use a protocol specifically designed for authenticated state rather than assuming OHTTP will hide them.
Quick Recap
Troubleshooting common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Key configuration is rejected | Wrong media type, unsupported algorithm, invalid signature, or stale key identifier. | Check the Accept request, returned media type, authenticated integrity, algorithm support, and rotation overlap. |
| Relay returns a transport error | Missing HTTPS, incorrect gateway route, certificate failure, or upstream timeout. | Validate both TLS legs, the stable gateway identity, relay-to-gateway DNS, and timeout policy. |
| Gateway cannot parse the request | Relay modified the encapsulated body or headers, or the client used a mismatched Binary HTTP/HPKE profile. | Compare the forwarded bytes, disable intermediary transformations, and verify client and gateway algorithm configuration. |
| Target rejects the request | Gateway authorization policy does not permit the method, path, origin, or content type. | Review the explicit allowlist and gateway-to-target credentials; do not solve the error by enabling arbitrary forwarding. |
| Responses cannot be decrypted | Gateway used the wrong response context, key, or encapsulation format. | Check response encapsulation, key identifiers, client context handling, and whether an intermediary altered the body. |
| Privacy review finds client identifiers | Inner payload, cookies, logs, or relay-added headers contain identifying data. | Scrub application fields, remove Via/Forwarded, review crash reporting, and minimize retention. |
Deployment checklist
- Client, relay, and gateway roles are implemented and documented separately.
- The relay has a fixed mapping to the intended gateway and is not an open proxy.
- HTTPS is enforced from client to relay and relay to gateway.
- Gateway key configuration is authenticated, integrity-protected, rotated with overlap, and fetched without exposing unnecessary client identifiers.
- The gateway enforces an allowlist of permitted targets, methods, paths, and payload sizes.
- Relay configuration strips identifying headers and avoids adding client metadata.
- Inner requests contain no unnecessary names, credentials, cookies, or other direct identifiers.
- Tests cover normal requests, malformed ciphertext, key rotation, redirects, policy failures, and upstream errors.
- Documentation states that OHTTP does not authenticate the target resource and does not prevent all traffic correlation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
