How can I lock this down to only cache for my Worker subrequests?
How can I lock this down to only cache for my Worker subrequests?
DCan't do this
DDIs this correct?
Dthat seems to break caching
Ecf-worker will never work in rules
ESo dont even try
EJust add the hostname as well, the only thing that can request a hostname not on your zone through a cache rule is your own workers.
Hostname contains "backblazeb2.com" should be sufficient
Hostname contains "backblazeb2.com" should be sufficient
DI should probably match by full hostname now that I think about it.. isn't there a chance I could shoot myself in the foot by caching something that's not meant to be public?
EMaybe, depends on the semantics of your worker I suppose
ERule syntax is pretty flexible, narrow it down as much as youre happy with
Dyeah, after thinking bout this more, I'm definitely gonna stick with limiting it. That way I don't have to be scared about another Worker doing fetch and getting private data 
EI believe you can even add secret request headers for each worker and then reference those in the rule
Ddoes this impact anything given that we already overrode stuff in the cache key area?
EI wouldnt touch it, it will cause origin cache-control to start overriding your settings in unpredictable ways
Dso do Cache Rules impact only saving cache results, or does it impact both saving and retriving cache results?
EDid a quick test to confirm and it impacts serving as well, if you dont match the rule then you get default cache behaviour instead. e.g. I made a rule to only cache https://erisa.dev/ html if you dont send
x-test: testing and when I send that header I get DYNAMIC even though its HIT without itDnice, thank you! Is there a special header that only a Worker would have, or do I need to maintain my own API-like key?
ENo special recommendations, I would just generate a uuid and stuff it in the worker with a custom header name that wont conflict with anything else
EThe threat model is pretty low for that because the worker has to be running on your zone to begin with, but if you think you might introduce user generated requests at some point then hey its useful
Dthanks! semi-related, how is it possible that my Worker's cache status is
hit when it's a POST request?
EDoes the worker make a GET subrequest?
Dthere actually was one edge case where I realized that was possible with code I've written (not exposed anymore, so people creeping the channel, please don't waste your time).
(not exposed anymore, so people creeping the channel, please don't waste your time).Elol
EIts a layered security model
EAll good
Dyes, it makes at least two requests though. Sometimes 1 is cached, sometimes 2 are cached, and sometimes 0 are cached.
EI assume the response to the client is derived from the response obejct of one of those? Because thats probably where the hit is coming from, and then it just gets passed back through and we're like oh okay thats a hit somehow
Dcorrect.
EThe cache logic doesn't run in front of the worker, it runs inside the worker based on your subrequests, so you can technically return hit to a POST as long as the subrequest (which is where cache logic happens) is a GET
Dis it because I'm returning a response with a
cf-cache-status header?Dif so, I'm surprised that's trusted, since it's provided by me and starts with
cf-EThere is also a really sneaky workaround with the cache api to cache a POST subrequest https://developers.cloudflare.com/workers/examples/cache-post-request/
but not possible with native fetch cache
but not possible with native fetch cache
EYeah
EIts stripped if the external server tries to inject one, but your Worker can (mostly) do whatever it wants. I'm fairly sure you can edit that to MISS and make cache analytics become very misleading
ERealistically all it impacts is your logs and analytics as well as what the client sees, the actual cache logic doesnt care about it
Dyeah, I do that in some of our Workers; in this case, going through the native fetch is better, because this is what happens if there's a cache miss:
- first subrequest goes through cache api, cache miss
- second subrequest goes through fetch
- first subrequest goes through fetch, cache miss or hit, still only 1 subrequest
EAlso native fetch cache will support tiered cache so bonus hit rate
Dah yes, that brings up another question! For my use-case, caching S3 subrequests to a single Backblaze, do these tier cache settings make sense?
Dand how can I confirm if tiered caching is actually doing anything?
EIf your goal is to minimise requests to Backblaze then yes thats perfect. If your goal was to minimise global response times and you had a ton of traffic from all around the world then Generic might be slightly better.
Dit's the former, ty!
ECacheTieredFill in logs will tell you whether it was used for a given request, you may need to inspect logs over an extended period before you find one because if you keep hitting the same colo its just going to serve from local colo cacheEsome ent customers will use logpush to send to data visualisation software and then graph the tiered cache fills over time
Dahhh neat, I see it now!
Dso right now I am running a script locally that's hitting my Worker (that does requests to B2's S3 API).
The Worker is running in MIA because that's the closest to me; when another service (i.e. Google Cloud Run) in IAD requests the same URL that was cached by my requests, will it:
The Worker is running in MIA because that's the closest to me; when another service (i.e. Google Cloud Run) in IAD requests the same URL that was cached by my requests, will it:
- Pull the MIA cache to IAD
- Not use the MIA cache at all, instead going to origin and saving that in IAD
- Something else?
EIt depends on what toplogy its using (which for smart is dynamically determined), I couldnt speak to it with any certainty
EBut if MIA was one of the colos in the toplogy and it was working optimally then yes it would pull it
EYou may also see in logs a
UpperTierColoID which will tell you which other colo the cache was fetched from, if not the local oneDThis is B2's IP. So does that mean my requests are already being cached in IAD?
EYeah. IAD will store cache and other colos will request copies from IAD if they dont have any locally
