Some examples from official Cloudflare repos, just in case: https://github.com/cloudflare/workers-sd

Some examples from official Cloudflare repos, just in case: https://github.com/cloudflare/workers-sdk/blob/main/packages/edge-preview-authenticated-proxy/wrangler.toml

JJames Some examples from official Cloudflare repos, just in case: https://github.com/c...

MrHerickZ•11/10/23, 6:04 PM

Awesome! I was just wondering cause I need separated environments + CI/CD, that will work for sure!

Sora Morimoto•11/10/23, 9:26 PM

We're trying to use Hyperdrive, but our team previously had an enterprise contract with Cloudflare, so Workers has a custom plan and it's not available. But when I ask support, they never reply. What's going on?!

Sora Morimoto•11/10/23, 9:27 PM

I explained the custom plan a few times, but my support person only replied like an AI chat bot, and after a few replies, no response. CAN ANYONE REALLY HELP ME???

SSora Morimoto We're trying to use Hyperdrive, but our team previously had an enterprise contra...

Erisa•11/10/23, 11:47 PM

Whats the ticket number?

Sora Morimoto•11/11/23, 12:01 AM

@Erisa | Support Engineer #2977253#2977253

Sora Morimoto•11/11/23, 12:03 AM

As mentioned in the ticket, my guess is that it should just work to revert changes around custom plan that were not cleaned up well

Sora Morimoto•11/11/23, 12:04 AM

Erisa•11/11/23, 12:07 AM

Yeah I see that now, sorry for the runaround I am looking into it

Erisa•11/11/23, 12:13 AM

@smorimoto Sorry that such a mess was made of your Enterprise downgrade, I've forwarded the ticket to the team who help with executing these along with instructions on what actions they need to take.
As it's currently out of hours for myself I will also follow up with a manager in working hours on Monday so I can see what we can do to hurry this along

Erisa•11/11/23, 12:15 AM

I work with the Enterprise support team and will keep myself on the ticket to make sure it's correctly handled

EErisa @smorimoto Sorry that such a mess was made of your Enterprise downgrade, I've fo...

Sora Morimoto•11/11/23, 12:18 AM

Thank you! We were going to do the Enterprise contract again, but to be very honest, we were very cautious because of the ticket. You definitely made me feel positive again!

Sora Morimoto•11/11/23, 12:19 AM

It's probably not a small deal for APAC, especially in Japan, and if it goes well, just hype up your great work! I will definitely sponsor that

jpony•11/11/23, 3:09 PM

Is there a way to ignore the "cancelled" status when a user starts an ajax request but closes the browser before it gets a response? Essentially, I just want the worker script to continue doing what it's doing, and just not send anything back if the user is no longer there

Raiyan•11/11/23, 3:24 PM

what package can I use to encrypt password in workers? does node bcrypt works in workers?

jpony•11/11/23, 3:27 PM

worker scripts have access to some web crypto libraries built in

jpony•11/11/23, 3:27 PM

https://developers.cloudflare.com/workers/runtime-apis/web-crypto/

Web Crypto · Cloudflare Workers docs

The Web Crypto API provides a set of low-level functions for common cryptographic tasks. The Workers Runtime implements the full surface of this API, …

jpony•11/11/23, 3:28 PM

So you could save a SHA-256 hash of their password, and then compare what they enter to the SHA-256 hash you save in a KV

Raiyan•11/11/23, 3:30 PM

should I use SHA-256 for password hashing? ChatGPT -> "SHA-256 is not suitable for securely hashing passwords because it is too fast and does not incorporate additional security measures like salting and iteration."

jpony•11/11/23, 3:34 PM

that's a decision you will have to make on your own

Raiyan•11/11/23, 4:36 PM

there used to be a airtable page where there are tested lists of packages that works with workers, do any of you know the link? I can't find it!

RRaiyan there used to be a airtable page where there are tested lists of packages that w...

Cyb3r-Jak3•11/11/23, 4:57 PM

It got removed because it was unmaintained. I use bycryptjs for passwords with my workers

Raiyan•11/11/23, 4:57 PM

Oh ok, thanks!

Unsmart•11/11/23, 5:01 PM

I also use bcryptjs fastnod

its easiest to get on workers but also interestingly there was some conversation on some laravel thing about how its better than argon2 but I dont know anything about passwords to know whats better really LUL

Unsmart•11/11/23, 5:06 PM

https://github.com/laravel/laravel/pull/6245#issuecomment-1730504804

To summarize, even some of the PHC judges acknowledge that, in order to achieve auth speeds in alignment with UX tolerance studies (500ms to 1 second of auth delay per user), both the Argon2 family and scrypt have to be tuned "downward" so much that they end up being less resistant to offline attack than bcrypt at equivalent auth speeds(!)

Unsmart•11/11/23, 5:20 PM

Im aware of what owasp recommends and im sure the maintainers of laravel are aware also but it seems they have information from people who run phc that argon isnt better unless > 1 second runtime

Unsmart•11/11/23, 5:21 PM

But take that information how you want

any of the options will be fine regardless

Ppetter It's an interesting tweet, but it's also 4 years old. I would guess there are mo...

Unsmart•11/11/23, 5:45 PM

https://twitter.com/jmgosney/status/1508435966234611714 he still seems to argue bcrypt over argon in 2022

Ppetter If it's useful for anyone, I created a argon2 worker a couple of days ago that c...

Steved•11/11/23, 8:47 PM

@Petter That looks really interesting. A concern of mine is that bcrypt.js on workers would be too slow to have decent work factor. Did you do any performance testing with your Argon2 worker? (with the OWASP suggested config for Argon2id - interation count 2, memory 19Mib)
Cloudflare crypto has native support for PBKDF2, so I was considering that too (it's not the OWASP preference, but is mentioned as an alternative).

kian•11/11/23, 8:53 PM

PBKDF2 is currently limited to 100,000 iterations on Workers, fyi

SSteved @Petter That looks really interesting. A concern of mine is that bcrypt.js on wo...

Unsmart•11/11/23, 8:58 PM

A like 12 or 13 cost bcrypt runs in 500ms and is plenty for the cost value

Kkian PBKDF2 is currently limited to 100,000 iterations on Workers, fyi

Steved•11/11/23, 9:36 PM

Argh. Thanks for the info, that's a pretty good argument against PBKDF2 given OSWAP suggests 600,000+.
And thanks @Unsmart | Tech debt yes, 12 or 13 should be fine, and 500ms seems reasonable.

sathoro•11/12/23, 6:22 AM

what's the best way to use fetch with a proxy from a Worker?

sathoro•11/12/23, 6:27 AM

can't find any proxy providers that support a dedicated IP with an API endpoint

bkyerv•11/12/23, 1:20 PM

is there any way to create folders in the dashboard where all workers and pages are listed so to group them by projects?

Bbkyerv is there any way to create folders in the dashboard where all workers and pages ...

Cyb3r-Jak3•11/12/23, 3:27 PM

Unfortunately not

bkyerv•11/12/23, 3:56 PM

is this something in the roadmap? I thought this is something that most people would want to use. or am I being biased? now when I heavily use cloudflare for many small projects I spent a lot of time finding my workers and pages.