does cloudflare have a nice solution for OAuth CSRF tokens? I don’t want to use kv, as it’s not real

U

Unsmart•12/28/23, 4:46 PM

KV is perfectly fine for CSRF tokens

can also use durable objects probably cheaper and faster also

UUnsmart KV is perfectly fine for CSRF tokens 🤷 can also use durable objects probably ch...

V

valkyrie_pilotOP•12/28/23, 5:01 PM

the main problem is the write pricing

V

valkyrie_pilotOP•12/28/23, 5:05 PM

Though i was clearly misremembering the pricing, as i thought the free tier was 1000 a month and its 1000 a day

Vvalkyrie_pilot the main problem is the write pricing

U

Unsmart•12/28/23, 5:24 PM

Durable objects are a lot cheaper. $1/million writes + 0.15/million for the invokes. D1 can also be a choice (for non production critical apps currently)

Vvalkyrie_pilot does cloudflare have a nice solution for OAuth CSRF tokens? I don’t want to use ...

D

dave•12/28/23, 5:34 PM

why not D1?

D

dave•12/28/23, 5:44 PM

@kian Is there any downside to storing S3 objects with gzip compression?

UUnsmart Durable objects are a lot cheaper. $1/million writes + 0.15/million for the invo...

V

valkyrie_pilotOP•12/28/23, 5:47 PM

nah, for my volumes 1000 writes/day is plenty

Ddave Is the Cache API shared among all Workers in a zone?

D

dave•12/28/23, 7:42 PM

Is the Cache API shared with

fetch

fetch

's cache?

Original message was deleted

D

dave•12/28/23, 9:27 PM

if you use aws4fetch, you can get free caching without needing to fiddle with the Cache API manually.

const aws_client = new AwsClient({
  accessKeyId: c.env.S3_ACCESS_KEY_ID,
  secretAccessKey: c.env.S3_SECRET_ACCESS_KEY,
  retries: 0,
  service: "s3",
})

const s3_url = new URL(`${c.env.S3_ENDPOINT}/${sha256}.json`);

const s3_result = await aws_client.fetch(s3_url.toString(), {
  method: "GET",
  cf: {
    cacheEverything: true,
    cacheTtl: 31536000, // 1 year
  }
});

const aws_client = new AwsClient({
  accessKeyId: c.env.S3_ACCESS_KEY_ID,
  secretAccessKey: c.env.S3_SECRET_ACCESS_KEY,
  retries: 0,
  service: "s3",
})

const s3_url = new URL(`${c.env.S3_ENDPOINT}/${sha256}.json`);

const s3_result = await aws_client.fetch(s3_url.toString(), {
  method: "GET",
  cf: {
    cacheEverything: true,
    cacheTtl: 31536000, // 1 year
  }
});

const aws_client = new AwsClient({
  accessKeyId: c.env.S3_ACCESS_KEY_ID,
  secretAccessKey: c.env.S3_SECRET_ACCESS_KEY,
  retries: 0,
  service: "s3",
})

const s3_url = new URL(`${c.env.S3_ENDPOINT}/${sha256}.json`);

const s3_result = await aws_client.fetch(s3_url.toString(), {
  method: "GET",
  cf: {
    cacheEverything: true,
    cacheTtl: 31536000, // 1 year
  }
});

const aws_client = new AwsClient({
  accessKeyId: c.env.S3_ACCESS_KEY_ID,
  secretAccessKey: c.env.S3_SECRET_ACCESS_KEY,
  retries: 0,
  service: "s3",
})

const s3_url = new URL(`${c.env.S3_ENDPOINT}/${sha256}.json`);

const s3_result = await aws_client.fetch(s3_url.toString(), {
  method: "GET",
  cf: {
    cacheEverything: true,
    cacheTtl: 31536000, // 1 year
  }
});

Original message was deleted

D

dave•12/28/23, 9:28 PM

Why?

D

dave•12/28/23, 11:04 PM

Do I pay for the idle time on the setTimeout?

for(let i = 0; i < 10; i++) {
    await new Promise(r => setTimeout(r, 5000));
    const result = await fetch(loc);
// ...
}

for(let i = 0; i < 10; i++) {
    await new Promise(r => setTimeout(r, 5000));
    const result = await fetch(loc);
// ...
}

for(let i = 0; i < 10; i++) {
    await new Promise(r => setTimeout(r, 5000));
    const result = await fetch(loc);
// ...
}

for(let i = 0; i < 10; i++) {
    await new Promise(r => setTimeout(r, 5000));
    const result = await fetch(loc);
// ...
}

J

James•12/28/23, 11:05 PM

In Unbound, you would pay for that wall time, yes. With Bundled, or the new Standard, no you will not

D

dave•12/28/23, 11:32 PM

thanks!

D

dave•12/28/23, 11:32 PM

I switched to standard just now

D

dave•12/28/23, 11:34 PM

How do I not have enough subrequests for smart placement..?

J

James•12/28/23, 11:50 PM

I'm not sure how accurate those analytics are for smart placement. Are you making multiple subrequests per request?

U

Unsmart•12/28/23, 11:54 PM

Exhibit a of why I hate smart placement instead of manual YEP

JJames I'm not sure how accurate those analytics are for smart placement. Are you makin...

D

dave•12/28/23, 11:57 PM

yes. 3 subrequests if there's no cache, or 0 if we hit the cache.

U

Unsmart•12/28/23, 11:58 PM

I wonder if the cache messes with it

D

dave•12/28/23, 11:58 PM

Will

cacheEverything: true

cacheEverything: true

cacheEverything: true

cacheEverything: true cache non-200 responses?

U

Unsmart•12/28/23, 11:59 PM

It should afaik you can set specific codes to limit the cache

D

dave•12/28/23, 11:59 PM

oh crap

Ddave @kian Is there any downside to storing S3 objects with gzip compression?

K

kian•12/29/23, 12:30 AM

Nope

UUnsmart It should afaik you can set specific codes to limit the cache

D

dave•12/29/23, 12:31 AM

sanity check, as long as my remote doesn't have a cache-control header, non-200's won't be cached, right?

Ddave sanity check, as long as my remote doesn't have a cache-control header, non-200'...

E

Erisa•12/29/23, 12:38 AM

No, there are defaults https://developers.cloudflare.com/cache/how-to/configure-cache-status-code/#edge-ttl

EErisa No, there are defaults <https://developers.cloudflare.com/cache/how-to/configure...

D

dave•12/29/23, 12:39 AM

ahh.. does a cache-control header override those?

E

Erisa•12/29/23, 12:39 AM

It does

E

Erisa•12/29/23, 12:40 AM

cache-control: no-store

cache-control: no-store

cache-control: no-store

cache-control: no-store should do the trick

EErisa It does

D

dave•12/29/23, 12:48 AM

oh sweet, so

cacheTtl

cacheTtl

cacheTtl

cacheTtl is probably a bad idea, ty!

I've removed it from my code.

UUnsmart Exhibit a of why I hate smart placement instead of manual <:YEP:8072727784654111...

D

dave•12/29/23, 12:50 AM

manual placement isn't a thing, is it?

Ddave manual placement isn't a thing, is it? 😛

U

Unsmart•12/29/23, 12:50 AM

Unfortunately it’s only “smart” placement currently

EErisa No, there are defaults <https://developers.cloudflare.com/cache/how-to/configure...

D

dave•12/29/23, 12:52 AM

How does

fetch

fetch

's cache behave with query strings?

Ddave How does `fetch`'s cache behave with query strings?

E

Erisa•12/29/23, 12:53 AM

It respects whatever cache setting you have for the zone the worker runs on

EErisa It respects whatever cache setting you have for the zone the worker runs on

D

dave•12/29/23, 12:53 AM

is there a way to configure that per-fetch?

E

Erisa•12/29/23, 12:55 AM

I don't believe so, no

D

dave•12/29/23, 12:55 AM

hmm, could I do a cache rule maybe?

E

Erisa•12/29/23, 12:55 AM

But while we're here, it seems fetch supports

cacheTtlByStatus

cacheTtlByStatus

cacheTtlByStatus

cacheTtlByStatus which sounds like it might help with the earlier query, mentioned a bit down from here: https://developers.cloudflare.com/workers/runtime-apis/request/#requestinitcfproperties

EErisa But while we're here, it seems fetch supports `cacheTtlByStatus` which sounds li...

D

dave•12/29/23, 12:56 AM

that's enterprise-only; I know I'm gonna forget about it when we downgrade off ent eventually

E

Erisa•12/29/23, 12:56 AM

Ah

E

Erisa•12/29/23, 12:56 AM

Okay

D

dave•12/29/23, 12:57 AM

what on earth, Backblaze returns a 403 when it can't find a file

D

dave•12/29/23, 12:57 AM

is that actually the s3 spec...?

J

James•12/29/23, 12:57 AM

cacheTtlByStatus

cacheTtlByStatus

cacheTtlByStatus

cacheTtlByStatus is ent? I thought it was for everyone?

EErisa `cache-control: no-store` should do the trick

D

dave•12/29/23, 12:57 AM

just confirmed, Backblaze B2 returns

Cache-Control: max-age=0, no-cache, no-store

Cache-Control: max-age=0, no-cache, no-store

Cache-Control: max-age=0, no-cache, no-store

Cache-Control: max-age=0, no-cache, no-store

when it's a 403 (missing file)

JJames `cacheTtlByStatus` is ent? I thought it was for everyone? 🤔

J

James•12/29/23, 12:59 AM

https://developers.cloudflare.com/workers/runtime-apis/request/#incomingrequestcfproperties doesn't mention this, but https://developers.cloudflare.com/cache/how-to/configure-cache-status-code/ kinda does in the first sentence. But then goes on to talk about free limits too. interesting

Ddave just confirmed, Backblaze B2 returns `Cache-Control: max-age=0, no-cache, no-st...

E

Erisa•12/29/23, 1:00 AM

You can do it with page rules. I had thought there was an equivalent in cache rules but I checked and can't find it so...
It feels wrong to write a page rule for a hostname thats not on the zone but I'm 99% sure it works