在浏览器中打开 PDF 链接（例如带有 ootb PDF 查看器插件的 google chrome）显然表明当 PDF 托管在面向 cloudflare 的域上时，嵌入代码中会存在其他数据。
当 PDF 位于 cloudflare 后面时，使用 chrome 开发工具检查显示的 PDF 文件的页面源会显示一些“报告”URL https://a.nel.cloudflare.com/report/v3?s=%2BW057P981N7Esg...（请参阅第二个代码块）。
未通过 cloudflare 提供的文件的 PDF 嵌入：
<embed id="plugin" type="application/x-google-chrome-pdf" src="https://www.w3.org/WAI/ER/tests/xhtml/testfiles/resources/pdf/dummy.pdf" stream-url="chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/f02f891e-7fd9-4857-8a34-f4e05abb87f8" headers="accept-ranges: bytes
cache-control: max-age=21600
content-length: 13264
content-type: application/pdf; qs=0.001
date: Sun, 05 Sep 2021 08:17:57 GMT
etag: "33d0-438b181451e00"
expires: Sun, 05 Sep 2021 14:17:57 GMT
last-modified: Mon, 27 Aug 2007 17:15:36 GMT
strict-transport-security: max-age=15552000; includeSubdomains; preload
x-backend: ssl-mirrors
" background-color="4283586137" javascript="allow" full-frame="" pdf-viewer-update-enabled="">
通过 cloudflare提供的文件的 PDF 嵌入：
<embed id="plugin" type="application/x-google-chrome-pdf" src="https://www.cloudflare.com/static/839a7f8c9ba01f8cfe9d0a41c53df20c/cloudflare-cdn-whitepaper-19Q4.pdf" stream-url="chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/fab5433b-5189-4469-91bb-fe144b761c7f" headers="accept-ranges: bytes
age: 105287
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: max-age=8640000
cf-cache-status: HIT
cf-ray: 689e1d381a951501-MAD
content-length: 921473
content-type: application/pdf
date: Sun, 05 Sep 2021 08:33:41 GMT
etag: static/839a7f8c9ba01f8cfe9d0a41c53df20c/cloudflare-cdn-whitepaper-19Q4.797a721498.pdf
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bi6bZw6jf1FJoimuy2arirenUDiwyZX%2B%2B1Ty506xD9qMJ5UggIvZAy2h8gKogsJORkPlWdnZ12udf6CN%2BadaEF0FRKFAyZQabI6xkui0%2FrV%2BaCFsp7BmbEHnoLk0HPmJ6pMeMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
" background-color="4283586137" javascript="allow" full-frame="" pdf-viewer-update-enabled="">
问题
这是否意味着 cloudflare 正在重写 PDF 嵌入的 HTML 源代码并跟踪通过浏览器 PDF 插件打开的 PDF 文件？这对安全/隐私有什么影响？禁用浏览器 PDF 嵌入插件会减少 cloudflare 收集的数据量吗？
特别令人困惑的是，<embed/>代码应该是由 PDF 浏览器插件生成的，而不是从传入的响应中生成的，那么这种重写如何专门针对 cloudflare 进行呢？