I want to prevent users using opera vpn from accessing my website. Can I do this with workers What k

I want to prevent users using opera vpn from accessing my website.
Can I do this with workers
What kind of query should I use if I can

Unsmart•7/13/23, 12:59 PM

Chaika•7/13/23, 12:59 PM

It got upgraded semi-recently

Unsmart•7/13/23, 1:00 PM

upgraded is an understatement

Llokiwind I want to prevent users using opera vpn from accessing my website. Can I do this...

Chaika•7/13/23, 1:02 PM

probably the easiest way would be to find all of the ASNs/Providers they use and block/challenge them, looks like they use SurfEasy under the hood, generally more trouble then it's worth imo

BBUTTΞRKΞKS1000 Ok maybe it wont show in the mobile view

Chaika•7/13/23, 1:06 PM

it should, although it's pretty unusable unless you're on a very wide phone/tablet or something. You don't see the button, or it doesn't load?

mystiquewolf•7/13/23, 5:45 PM

Does cloudflare automatically add CAA records for free Universal SSL customers? https://developers.cloudflare.com/ssl/edge-certificates/caa-records/

Add CAA records · Cloudflare SSL/TLS docs

A Certificate Authority Authorization (CAA) DNS record specifies which certificate authorities (CAs) are allowed to issue certificates for a domain. …

mystiquewolf•7/13/23, 5:46 PM

i don't see such added. How to prevent others CAs than the ones that Cloudflare uses?

mystiquewolf•7/13/23, 5:48 PM

I mean i see that they won't appear in the dashbard, but dig doesn't show CAA records too. AFAIU Cloudflare adds it's own CAA records if you try to add at least one custom CAA. But what if i don't want a custom one but only the Cloudflare ones?

mystiquewolf•7/13/23, 5:49 PM

This has not been well thought feature

Cyb3r-Jak3•7/13/23, 5:52 PM

^ Cloudflare doesn’t know if you have certificates for servers from other CAs so it doesn’t want to break those

Cyb3r-Jak3•7/13/23, 5:53 PM

If you have a DNS only record that has a certificate from a CA and then if Cloudflare auto adds a CAA record that you can’t see then it could break the origin cert

mystiquewolf•7/13/23, 6:32 PM

i see cloudflare uses Sectigo and Google Trust Services

mystiquewolf•7/13/23, 6:32 PM

So it is okay to deploy CAA for these two?

mystiquewolf•7/13/23, 6:33 PM

i haven't looked much into this

mystiquewolf•7/13/23, 6:33 PM

Ah this now seems like an intelligent answer

mystiquewolf•7/13/23, 6:34 PM

i did but i didn't think of empty CAA

mystiquewolf•7/13/23, 6:35 PM

i've never used CAA and just reading about it now. I wondered if it's possible to lockdown only the Cloudflare issuers. Your reply about empty CAA seems to be somehow legit.

Mmystiquewolf i've never used CAA and just reading about it now. I wondered if it's possible t...

mystiquewolf•7/13/23, 6:40 PM

like i wonder is empty CAA valid or would cause trouble 0 issue " "0 issue " "

mystiquewolf•7/13/23, 6:40 PM

that's from digdig

mystiquewolf•7/13/23, 6:41 PM

you're right tho cloudflare does add their own CAA's in addition to my custom/empty one

mystiquewolf•7/13/23, 6:42 PM

but that's documented so i expected it. I just wondered why should i explicitly add CAA and think about what to input there and why there is no toggle to just force Cloudflare add their own CAA providers

mystiquewolf•7/13/23, 7:14 PM

I get these kind of emails about every 2 or so days

The certificate with the ID ....... belonging to Zone ID ......... has been deployed to Cloudflare's edge.

The certificate with the ID ....... belonging to Zone ID ......... has been deployed to Cloudflare's edge.

mystiquewolf•7/13/23, 7:15 PM

i've enabled certificate transparency alerts, but why so frequent deploys?

mystiquewolf•7/13/23, 7:15 PM

The SSL certificate is 3 months valid

mystiquewolf•7/13/23, 7:16 PM

one has 3 months validity, other (backup) 1 year

mystiquewolf•7/13/23, 7:16 PM

no need to rotate every 2 days or every week...

mystiquewolf•7/13/23, 7:16 PM

maybe it's something different feature or else a bug

Mmystiquewolf i've enabled certificate transparency alerts, but why so frequent deploys?

Chaika•7/13/23, 7:19 PM

Those aren't cert transparency emails, you enabled notifications for Universal ssl alerts or custom hostname ssl alerts

Chaika•7/13/23, 7:20 PM

The cert transparency emails are way less spammy and include no details about your zone/cert ids (because they're generic and watch certs from every issuer)

CChaika Those aren't cert transparency emails, you enabled notifications for Universal s...

mystiquewolf•7/13/23, 7:23 PM

Thanks very much I'll disable ASAP

fleabeard•7/13/23, 8:15 PM

Hey folks, I'm trying to get an http website up and running before I do the needful to get https working. However, when I try to visit the site via the http:// address it's auto-directing me to the https:// which isn't setup yet with an Error code 521. Any ideas?

MattIPv4•7/13/23, 8:16 PM

Do you have always use https enabled?

MattIPv4•7/13/23, 8:17 PM

Is your domain in the hsts preload list?

MattIPv4•7/13/23, 8:17 PM

Is your origin returing the redirect?

MattIPv4•7/13/23, 8:19 PM

That being said, if this is being proxied through Cloudflare, what's happening between you and Cloudflare (http vs https) shouldn't change how Cloudflare is connecting to your origin. If your origin isn't configured to support TLS, have you set the correct SSL mode for the zone (flexible)?

fleabeard•7/13/23, 8:20 PM

Ah, changing it to flexible allowed the page to load lol. Thanks!

Mmystiquewolf like i wonder is empty CAA valid or would cause trouble `0 issue " "`

mystiquewolf•7/13/23, 8:27 PM

should not cause trouble. Nice trick Leo, thanks
Out of the DNS CAA RFC:

CAA authorizations are additive; thus, the result of specifying both an empty issuer-domain-name and a non-empty issuer-domain-name is the same as specifying just the non-empty issuer-domain-name.

CAA authorizations are additive; thus, the result of specifying both an empty issuer-domain-name and a non-empty issuer-domain-name is the same as specifying just the non-empty issuer-domain-name.

F0rce•7/13/23, 8:43 PM

Hello everyone, I want to build something with workers and I am not sure if it works out, thats why im asking POGGIES

Basically I have some workers and I want to add some oberservability to it. I would like to use Service Bindings for that. Now here's the question I have. I have the following in mind.

Request is made to Worker One (availible online). It does it normal job does some additional "pre-parsing" for the logger (saving some request headers / response headers).
The request where the original reqeust is made to does a subrequest (through a Service Binding) to the logger worker. Due to limitation of our log provider (axiom) I would not be able to ingest every request when it happens.

How would I have to build the logger service, that it throttles the requests made ? or is there a better solution to what I'm thinking. I'm open for all sorts of "help".

Thanks blob_wave

I want to prevent users using opera vpn from accessing my website. Can I do this with workers What k

Similar Threads

Similar Threads

Similar Threads