Cloudflare Developers•2y ago

https://up.erisa.uk/firefox_8oxmdgOT2s.png

ErisaOP•12/29/23, 1:11 AM

I think they would have the same effect, this one just makes more sense in my mind

ErisaOP•12/29/23, 1:12 AM

(note that due to the cache-control spec being super weird you have to do no-store and should not pick no-cache)

EErisa (note that due to the cache-control spec being super weird you have to do no-sto...

dave•12/29/23, 1:12 AM

yeah that threw me off earlier today too

EErisa https://up.erisa.uk/firefox_8oxmdgOT2s.png

dave•12/29/23, 1:14 AM

Ddave what on earth, Backblaze returns a 403 when it can't find a file

dave•12/29/23, 1:16 AM

ah, this is probably because I only gave the B2/S3 API key permissions to read and write files, not list files.

Ddave Click to see attachment

ErisaOP•12/29/23, 1:18 AM

Nice, though we dont cache any 1xx by default and I'm pretty sure the TTL override at the top only applies to 200 :P
Either way, good to be explicit like that and its more clear in future what this rule is doing and can be easily adjusted if needed!

dave•12/29/23, 1:19 AM

also did this to avoid caching versioned presigned URLs.

ErisaOP•12/29/23, 1:20 AM

Fancy

EErisa Click to see attachment

dave•12/29/23, 1:20 AM

is this the same as toggling

no query parameters

no query parameters

ErisaOP•12/29/23, 1:23 AM

Yes

ErisaOP•12/29/23, 1:23 AM

The top option is that setting off, the bottom is it on, the ones in the middle are fun ent bonuses

dave•12/29/23, 1:23 AM

hmm, it doesn't seem to be working :/

dave•12/29/23, 1:23 AM

oh wait

dave•12/29/23, 1:24 AM

yep, it's working!

dave•12/29/23, 1:24 AM

ty!

dave•12/29/23, 1:25 AM

How can I lock this down to only cache for my Worker subrequests?

dave•12/29/23, 1:28 AM

(http.request.uri.query contains "X-Amz-Algorithm=AWS4-HMAC-SHA256" and not http.request.uri.query contains "versionId") and cf.worker.upstream_zone in {"aimoda.workers.dev" "ai.moda"}

(http.request.uri.query contains "X-Amz-Algorithm=AWS4-HMAC-SHA256" and not http.request.uri.query contains "versionId") and cf.worker.upstream_zone in {"aimoda.workers.dev" "ai.moda"}

Can't do this

dave•12/29/23, 1:30 AM

(http.request.uri.query contains "X-Amz-Algorithm=AWS4-HMAC-SHA256" and not http.request.uri.query contains "versionId" and any(http.request.headers["cf-worker"][*] in {"ai.moda" "aimoda.workers.dev"}))

(http.request.uri.query contains "X-Amz-Algorithm=AWS4-HMAC-SHA256" and not http.request.uri.query contains "versionId" and any(http.request.headers["cf-worker"][*] in {"ai.moda" "aimoda.workers.dev"}))

dave•12/29/23, 1:30 AM

Is this correct?

dave•12/29/23, 1:32 AM

that seems to break caching

ErisaOP•12/29/23, 1:32 AM

cf-worker will never work in rules

ErisaOP•12/29/23, 1:32 AM

So dont even try

Ddave How can I lock this down to only cache for my Worker subrequests?

ErisaOP•12/29/23, 1:32 AM

Just add the hostname as well, the only thing that can request a hostname not on your zone through a cache rule is your own workers.
Hostname contains "backblazeb2.com" should be sufficient

EErisa Just add the hostname as well, the only thing that can request a hostname not on...

dave•12/29/23, 1:36 AM

I should probably match by full hostname now that I think about it.. isn't there a chance I could shoot myself in the foot by caching something that's not meant to be public?

ErisaOP•12/29/23, 1:36 AM

Maybe, depends on the semantics of your worker I suppose

ErisaOP•12/29/23, 1:37 AM

Rule syntax is pretty flexible, narrow it down as much as youre happy with

EErisa Maybe, depends on the semantics of your worker I suppose

dave•12/29/23, 1:38 AM

yeah, after thinking bout this more, I'm definitely gonna stick with limiting it. That way I don't have to be scared about another Worker doing fetch and getting private data

ErisaOP•12/29/23, 1:39 AM

I believe you can even add secret request headers for each worker and then reference those in the rule

dave•12/29/23, 1:39 AM

does this impact anything given that we already overrode stuff in the cache key area?

ErisaOP•12/29/23, 1:40 AM

I wouldnt touch it, it will cause origin cache-control to start overriding your settings in unpredictable ways

EErisa I believe you can even add secret request headers for each worker and then refer...

dave•12/29/23, 1:40 AM

so do Cache Rules impact only saving cache results, or does it impact both saving and retriving cache results?

Ddave so do Cache Rules impact only saving cache results, or does it impact both savin...

ErisaOP•12/29/23, 1:44 AM

Did a quick test to confirm and it impacts serving as well, if you dont match the rule then you get default cache behaviour instead. e.g. I made a rule to only cache https://erisa.dev/ html if you dont send

x-test: testing

x-test: testing

and when I send that header I get DYNAMIC even though its HIT without it

EErisa Did a quick test to confirm and it impacts serving as well, if you dont match th...

dave•12/29/23, 1:45 AM

nice, thank you! Is there a special header that only a Worker would have, or do I need to maintain my own API-like key?

ErisaOP•12/29/23, 1:45 AM

No special recommendations, I would just generate a uuid and stuff it in the worker with a custom header name that wont conflict with anything else

ErisaOP•12/29/23, 1:47 AM

The threat model is pretty low for that because the worker has to be running on your zone to begin with, but if you think you might introduce user generated requests at some point then hey its useful

dave•12/29/23, 1:47 AM

thanks! semi-related, how is it possible that my Worker's cache status is

hit

hit

when it's a POST request?

ErisaOP•12/29/23, 1:48 AM

Does the worker make a GET subrequest?

EErisa The threat model is pretty low for that because the worker has to be running on ...

dave•12/29/23, 1:48 AM

there actually was one edge case where I realized that was possible with code I've written

(not exposed anymore, so people creeping the channel, please don't waste your time).

ErisaOP•12/29/23, 1:49 AM

lol

ErisaOP•12/29/23, 1:49 AM

Its a layered security model

ErisaOP•12/29/23, 1:49 AM

All good

EErisa Does the worker make a GET subrequest?

dave•12/29/23, 1:49 AM

yes, it makes at least two requests though. Sometimes 1 is cached, sometimes 2 are cached, and sometimes 0 are cached.

ErisaOP•12/29/23, 1:50 AM

I assume the response to the client is derived from the response obejct of one of those? Because thats probably where the hit is coming from, and then it just gets passed back through and we're like oh okay thats a hit somehow

EErisa I assume the response to the client is derived from the response obejct of one o...

dave•12/29/23, 1:50 AM

correct.

ErisaOP•12/29/23, 1:51 AM

The cache logic doesn't run in front of the worker, it runs inside the worker based on your subrequests, so you can technically return hit to a POST as long as the subrequest (which is where cache logic happens) is a GET

EErisa The cache logic doesn't run in front of the worker, it runs inside the worker ba...

dave•12/29/23, 1:52 AM

is it because I'm returning a response with a

cf-cache-status

cf-cache-status

header?

dave•12/29/23, 1:52 AM

if so, I'm surprised that's trusted, since it's provided by me and starts with

cf-

cf-

ErisaOP•12/29/23, 1:52 AM

There is also a really sneaky workaround with the cache api to cache a POST subrequest https://developers.cloudflare.com/workers/examples/cache-post-request/
but not possible with native fetch cache

Ddave is it because I'm returning a response with a `cf-cache-status` header?

ErisaOP•12/29/23, 1:52 AM

Yeah

Ddave if so, I'm surprised that's trusted, since it's provided by me and starts with `...

ErisaOP•12/29/23, 1:53 AM

Its stripped if the external server tries to inject one, but your Worker can (mostly) do whatever it wants. I'm fairly sure you can edit that to MISS and make cache analytics become very misleading

(http.request.uri.query contains "X-Amz-Algorithm=AWS4-HMAC-SHA256" and not http.request.uri.query contains "versionId" and any(http.request.headers["cf-worker"][*] in {"ai.moda" "aimoda.workers.dev"}))

https://up.erisa.uk/firefox_8oxmdgOT2s.png

Similar Threads

Similar Threads

Similar Threads