I am using middleware in `/functions` to secure some pages. But when the url has double slashes `//`

S

ShivamOP•8/5/23, 7:35 AM

More description on the issue
It's replicated in https://github.com/Shivam010/cloudflare-double-slashes-issue

There's a middleware in

/functions/secure

/functions/secure

/functions/secure

/functions/secure directory to be applied on all routes of

/secure

/secure

/secure

/secure.

And the

/out/secure

/out/secure

/out/secure

/out/secure directory contains a file

one.html

one.html

one.html

one.html which should be served at

/secure/one

/secure/one

/secure/one

/secure/one (but first the middleware needs to be invoked)

The issue is...

The middleware is properly invoked on

/secure/one

/secure/one

/secure/one

/secure/one route but not on the

//secure/one

//secure/one

//secure/one

//secure/one, whenever someone uses a double slash before the middleware directory, wrangler doesn't run the middleware and instead directly serve the pages.

Links
Github Repo: https://github.com/Shivam010/cloudflare-double-slashes-issue
Hosted on: https://double-slashes-issue.pages.dev

/secure/one

/secure/one

/secure/one

/secure/one route – https://double-slashes-issue.pages.dev/secure/one

//secure/one

//secure/one

//secure/one

//secure/one route – https://double-slashes-issue.pages.dev//secure/one

/secure/one?allow

/secure/one?allow

/secure/one?allow

/secure/one?allow route – https://double-slashes-issue.pages.dev/secure/one?allow (that's actually allowed by middleware)

GitHub

GitHub - Shivam010/cloudflare-double-slashes-issue

Contribute to Shivam010/cloudflare-double-slashes-issue development by creating an account on GitHub.

S

Soham•8/12/23, 12:45 PM

Anyway I can make a blog using pages functions and workers for my pages website?

MMy Account I have created a nice web app for exploring purposes I dont know backend stuff ...

D

Dahoom•8/13/23, 11:50 AM

Look in the dashboard, in your pages project in the settings tab there is an environment variable option that you can set and encrypt for both preview and production branches

C

Cretezy•8/13/23, 9:37 PM

Currently trying to test Functions locally using

npx wrangler pages dev .

npx wrangler pages dev .

npx wrangler pages dev .

npx wrangler pages dev . (

contains a directory with

functions

functions

functions

functions) and getting the following error:

CCretezy Currently trying to test Functions locally using `npx wrangler pages dev .` (`.`...

J

James•8/13/23, 9:40 PM

Try downgrading to wrangler 3.4.0. 3.5.0 has an issue that's hiding some useful error logs from workerd.

C

Cretezy•8/13/23, 9:41 PM

workerd/util/symbolizer.c++:99: warning: Not symbolizing stack traces because $LLVM_SYMBOLIZER is not set. To symbolize stack traces, set $LLVM_SYMBOLIZER to the location of the llvm-symbolizer binary. When running tests under bazel, use --test_env=LLVM_SYMBOLIZER=<path>.

workerd/util/symbolizer.c++:99: warning: Not symbolizing stack traces because $LLVM_SYMBOLIZER is not set. To symbolize stack traces, set $LLVM_SYMBOLIZER to the location of the llvm-symbolizer binary. When running tests under bazel, use --test_env=LLVM_SYMBOLIZER=<path>.

workerd/util/symbolizer.c++:99: warning: Not symbolizing stack traces because $LLVM_SYMBOLIZER is not set. To symbolize stack traces, set $LLVM_SYMBOLIZER to the location of the llvm-symbolizer binary. When running tests under bazel, use --test_env=LLVM_SYMBOLIZER=<path>.

workerd/util/symbolizer.c++:99: warning: Not symbolizing stack traces because $LLVM_SYMBOLIZER is not set. To symbolize stack traces, set $LLVM_SYMBOLIZER to the location of the llvm-symbolizer binary. When running tests under bazel, use --test_env=LLVM_SYMBOLIZER=<path>.

C

Cretezy•8/13/23, 9:42 PM

I have LLVM 15.0.7 installed, and

llvm-symbolizer

llvm-symbolizer

llvm-symbolizer

llvm-symbolizer is in

$PATH

$PATH

.

J

James•8/13/23, 9:44 PM

any other errors? What's your functions look like?

C

Cretezy•8/13/23, 9:45 PM

LLVM_SYMBOLIZER=(which llvm-symbolizer) npx wrangler@3.4 pages dev .

LLVM_SYMBOLIZER=(which llvm-symbolizer) npx wrangler@3.4 pages dev .

LLVM_SYMBOLIZER=(which llvm-symbolizer) npx wrangler@3.4 pages dev .

LLVM_SYMBOLIZER=(which llvm-symbolizer) npx wrangler@3.4 pages dev . seems to work!

J

James•8/13/23, 9:45 PM

Is there another line perhaps under that one? Can you screenshot again?

J

James•8/13/23, 9:45 PM

...that really should not be required

C

Cretezy•8/13/23, 9:46 PM

J

James•8/13/23, 9:46 PM

ahh okay,

address already in use

address already in use

address already in use

address already in use

J

James•8/13/23, 9:46 PM

you have another

workerd

workerd

workerd

workerd process open somewhere

C

Cretezy•8/13/23, 9:46 PM

Sorry, there's also another error in there. Port wasn't used before

C

Cretezy•8/13/23, 9:47 PM

Worked once I

kill

kill

kill

killed it

J

James•8/13/23, 9:47 PM

not sure how that happened, but yeah, kill other workerd processes and you should be good

C

Cretezy•8/13/23, 9:47 PM

Yeah works without the env var now too, not sure what happened

C

Cretezy•8/13/23, 9:48 PM

How does functions work locally though? Do I run in the directory that contains

functions

functions

functions

functions, or in

functions

functions

functions

functions itself?

C

Cretezy•8/13/23, 9:49 PM

Sorry it actually is working in the parent directory... long day

J

James•8/13/23, 9:49 PM

public
   - index.html
functions
   - some-page.ts

public
   - index.html
functions
   - some-page.ts

public
   - index.html
functions
   - some-page.ts

public
   - index.html
functions
   - some-page.ts

J

James•8/13/23, 9:49 PM

yeah, something like that. Glad you got it working

C

Cretezy•8/13/23, 9:49 PM

Thanks

C

Cretezy•8/14/23, 12:53 AM

Hi! I'm having another issue with Cloudflare Pages Function. I am trying to implement Steam login, which is OpenID. Basically Steam redirects to the Worker with some query parameters, and I need to call the Steam API with some of those.

I tested this locally using wrangler, and it worked as expected. I then deployed it, and started getting

403 Forbidden

403 Forbidden

403 Forbidden

403 Forbidden from the Steam API (

https://steamcommunity.com/openid/login

https://steamcommunity.com/openid/login

https://steamcommunity.com/openid/login

https://steamcommunity.com/openid/login)

I thought this could have been that Cloudflare IPs are being blocked, so I setup a proxy (and tested it), and it's still doing the same, indicating that it's something else from the Worker runtime that's affecting the request.

For reference, this is the request I am making:

  const body = {
    "openid.assoc_handle": searchParams.get("openid.assoc_handle") ?? "",
    "openid.signed": searchParams.get("openid.signed") ?? "",
    "openid.sig": searchParams.get("openid.sig") ?? "",
    "openid.ns": OPENID.ns,
    "openid.mode": "check_authentication",
    "openid.op_endpoint": OPENID.endpoint,
    "openid.claimed_id": searchParams.get("openid.claimed_id") ?? "",
    "openid.identity": searchParams.get("openid.identity") ?? "",
    "openid.return_to": returnTo,
    "openid.response_nonce": searchParams.get("openid.response_nonce") ?? "",
  };
  const openidResponse = await fetch(
    "https://<steam-proxy>/steamcommunity.com/openid/login",
    {
      method: "POST",
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
      },
      body: new URLSearchParams(body),
    },
  );

  const body = {
    "openid.assoc_handle": searchParams.get("openid.assoc_handle") ?? "",
    "openid.signed": searchParams.get("openid.signed") ?? "",
    "openid.sig": searchParams.get("openid.sig") ?? "",
    "openid.ns": OPENID.ns,
    "openid.mode": "check_authentication",
    "openid.op_endpoint": OPENID.endpoint,
    "openid.claimed_id": searchParams.get("openid.claimed_id") ?? "",
    "openid.identity": searchParams.get("openid.identity") ?? "",
    "openid.return_to": returnTo,
    "openid.response_nonce": searchParams.get("openid.response_nonce") ?? "",
  };
  const openidResponse = await fetch(
    "https://<steam-proxy>/steamcommunity.com/openid/login",
    {
      method: "POST",
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
      },
      body: new URLSearchParams(body),
    },
  );

  const body = {
    "openid.assoc_handle": searchParams.get("openid.assoc_handle") ?? "",
    "openid.signed": searchParams.get("openid.signed") ?? "",
    "openid.sig": searchParams.get("openid.sig") ?? "",
    "openid.ns": OPENID.ns,
    "openid.mode": "check_authentication",
    "openid.op_endpoint": OPENID.endpoint,
    "openid.claimed_id": searchParams.get("openid.claimed_id") ?? "",
    "openid.identity": searchParams.get("openid.identity") ?? "",
    "openid.return_to": returnTo,
    "openid.response_nonce": searchParams.get("openid.response_nonce") ?? "",
  };
  const openidResponse = await fetch(
    "https://<steam-proxy>/steamcommunity.com/openid/login",
    {
      method: "POST",
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
      },
      body: new URLSearchParams(body),
    },
  );

  const body = {
    "openid.assoc_handle": searchParams.get("openid.assoc_handle") ?? "",
    "openid.signed": searchParams.get("openid.signed") ?? "",
    "openid.sig": searchParams.get("openid.sig") ?? "",
    "openid.ns": OPENID.ns,
    "openid.mode": "check_authentication",
    "openid.op_endpoint": OPENID.endpoint,
    "openid.claimed_id": searchParams.get("openid.claimed_id") ?? "",
    "openid.identity": searchParams.get("openid.identity") ?? "",
    "openid.return_to": returnTo,
    "openid.response_nonce": searchParams.get("openid.response_nonce") ?? "",
  };
  const openidResponse = await fetch(
    "https://<steam-proxy>/steamcommunity.com/openid/login",
    {
      method: "POST",
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
      },
      body: new URLSearchParams(body),
    },
  );

It works locally with

wranger pages dev

wranger pages dev

wranger pages dev

wranger pages dev, but not when deployed. Here's the same in Insomnia (Postman)

C

Cretezy•8/14/23, 12:54 AM

<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n

<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n

<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n

<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n

is what's being returned when deployed

K

kian•8/14/23, 12:55 AM

I'm pretty sure Steam block Cloudflare Workers, and by extension Functions.

K

kian•8/14/23, 12:55 AM

Are you stripping the CF-Worker request header in your proxy?

Kkian Are you stripping the CF-Worker request header in your proxy?

C

Cretezy•8/14/23, 12:55 AM

I am not, let me try that. Is this documented anywhere?

K

kian•8/14/23, 12:56 AM

https://developers.cloudflare.com/fundamentals/get-started/reference/http-request-headers/#cf-worker

K

kian•8/14/23, 12:56 AM

It's just a guess - it could also just be that you're not including a

User-Agent

User-Agent

User-Agent

User-Agent.

C

Cretezy•8/14/23, 12:57 AM

For the future, would be great if this page was linked from https://developers.cloudflare.com/workers/runtime-apis/fetch/

Fetch · Cloudflare Workers docs

The Fetch API provides an interface for asynchronously fetching resources via HTTP requests inside of a Worker.

Kkian Are you stripping the CF-Worker request header in your proxy?

C

Cretezy•8/14/23, 12:59 AM

Yes, this was it! Thank you so much.

Kkian <https://developers.cloudflare.com/fundamentals/get-started/reference/http-reque...

C

Cretezy•8/14/23, 3:00 AM

It is possible to strip this at the fetch level? E.g. By settings it in the headers param

K

kian•8/14/23, 3:00 AM

Nope, it's there intentionally to identify Workers.

C

Cretezy•8/14/23, 3:55 AM

Got it, thank you!

O

os•8/14/23, 5:06 AM

Hello.
https://r2-books.oster.dev/ta-today/004.png

by public link i can get metadata in response header?

O

os•8/14/23, 5:10 AM

I will display images on pre-generated pages
pages private used zero trust
image public

S

Sehban•8/14/23, 12:32 PM

Hi, Greetings of the day,

I have a SPA written in angular deployed on cloudflare pages. The root has "main.js" which should be served when called the domain. It is working flawlessly. Now, I am trying to implement Server Side Rendering on it using cloudflare functions. Can anyone share a short code snippet of cloudflare functions, where for every HTTP request, a rendered version of "main.js" is served. Please note I am trying to render it first on functions itself.
I am trying to achieve what is mentioned here: https://blog.cloudflare.com/pages-full-stack-frameworks/
Thanks in advance..

The Cloudflare Blog

Server-side render full stack applications with Pages Functions

Page Functions are now out of beta, bringing the ability to add dynamic server-side rendering to your applications. Pages makes it easy to deploy applications built using all the major frameworks.

YYoavBls Hi there, since the function folder combines the functions into the same worker,...

H

Hello, I’m Allie!•8/14/23, 1:09 PM

You cannot, no

YYoavBls Thanks So if my project nearly exceeds the size limit, should I create another p...

H

Hello, I’m Allie!•8/14/23, 1:21 PM

There isn't really an easy way to merge two projects together at the moment. Are you currently approaching a 5 MB script?

I am using middleware in `/functions` to secure some pages. But when the url has double slashes `//`

Similar Threads

Similar Threads

Similar Threads