The threat model is pretty low for that because the worker has to be running on your zone to begin w

The threat model is pretty low for that because the worker has to be running on your zone to begin with, but if you think you might introduce user generated requests at some point then hey its useful

dave•12/29/23, 1:47 AM

thanks! semi-related, how is it possible that my Worker's cache status is hithit when it's a POST request?

ErisaOP•12/29/23, 1:48 AM

Does the worker make a GET subrequest?

EErisa The threat model is pretty low for that because the worker has to be running on ...

dave•12/29/23, 1:48 AM

there actually was one edge case where I realized that was possible with code I've written

(not exposed anymore, so people creeping the channel, please don't waste your time).

ErisaOP•12/29/23, 1:49 AM

lol

ErisaOP•12/29/23, 1:49 AM

Its a layered security model

ErisaOP•12/29/23, 1:49 AM

All good

EErisa Does the worker make a GET subrequest?

dave•12/29/23, 1:49 AM

yes, it makes at least two requests though. Sometimes 1 is cached, sometimes 2 are cached, and sometimes 0 are cached.

ErisaOP•12/29/23, 1:50 AM

I assume the response to the client is derived from the response obejct of one of those? Because thats probably where the hit is coming from, and then it just gets passed back through and we're like oh okay thats a hit somehow

EErisa I assume the response to the client is derived from the response obejct of one o...

dave•12/29/23, 1:50 AM

correct.

ErisaOP•12/29/23, 1:51 AM

The cache logic doesn't run in front of the worker, it runs inside the worker based on your subrequests, so you can technically return hit to a POST as long as the subrequest (which is where cache logic happens) is a GET

EErisa The cache logic doesn't run in front of the worker, it runs inside the worker ba...

dave•12/29/23, 1:52 AM

is it because I'm returning a response with a

cf-cache-status

cf-cache-status

header?

dave•12/29/23, 1:52 AM

if so, I'm surprised that's trusted, since it's provided by me and starts with

cf-

cf-

ErisaOP•12/29/23, 1:52 AM

There is also a really sneaky workaround with the cache api to cache a POST subrequest https://developers.cloudflare.com/workers/examples/cache-post-request/
but not possible with native fetch cache

Ddave is it because I'm returning a response with a `cf-cache-status` header?

ErisaOP•12/29/23, 1:52 AM

Yeah

Ddave if so, I'm surprised that's trusted, since it's provided by me and starts with `...

ErisaOP•12/29/23, 1:53 AM

Its stripped if the external server tries to inject one, but your Worker can (mostly) do whatever it wants. I'm fairly sure you can edit that to MISS and make cache analytics become very misleading

ErisaOP•12/29/23, 1:54 AM

Realistically all it impacts is your logs and analytics as well as what the client sees, the actual cache logic doesnt care about it

EErisa There is also a really sneaky workaround with the cache api to cache a POST subr...

dave•12/29/23, 1:54 AM

yeah, I do that in some of our Workers; in this case, going through the native fetch is better, because this is what happens if there's a cache miss:

first subrequest goes through cache api, cache miss
second subrequest goes through fetch

vs. with just fetch:

first subrequest goes through fetch, cache miss or hit, still only 1 subrequest

ErisaOP•12/29/23, 1:55 AM

Also native fetch cache will support tiered cache so bonus hit rate

EErisa Also native fetch cache will support tiered cache so bonus hit rate

dave•12/29/23, 1:56 AM

ah yes, that brings up another question! For my use-case, caching S3 subrequests to a single Backblaze, do these tier cache settings make sense?

Ddave ah yes, that brings up another question! For my use-case, caching S3 subrequests...

dave•12/29/23, 1:56 AM

and how can I confirm if tiered caching is actually doing anything?

Ddave ah yes, that brings up another question! For my use-case, caching S3 subrequests...

ErisaOP•12/29/23, 1:57 AM

If your goal is to minimise requests to Backblaze then yes thats perfect. If your goal was to minimise global response times and you had a ton of traffic from all around the world then Generic might be slightly better.

EErisa If your goal is to minimise requests to Backblaze then yes thats perfect. If you...

dave•12/29/23, 1:58 AM

it's the former, ty!

Ddave and how can I confirm if tiered caching is actually doing anything?

ErisaOP•12/29/23, 1:58 AM

CacheTieredFill

CacheTieredFill

in logs will tell you whether it was used for a given request, you may need to inspect logs over an extended period before you find one because if you keep hitting the same colo its just going to serve from local colo cache

ErisaOP•12/29/23, 1:59 AM

some ent customers will use logpush to send to data visualisation software and then graph the tiered cache fills over time

dave•12/29/23, 2:00 AM

ahhh neat, I see it now!

EErisa `CacheTieredFill` in logs will tell you whether it was used for a given request,...

dave•12/29/23, 2:02 AM

so right now I am running a script locally that's hitting my Worker (that does requests to B2's S3 API).

The Worker is running in MIA because that's the closest to me; when another service (i.e. Google Cloud Run) in IAD requests the same URL that was cached by my requests, will it:

Pull the MIA cache to IAD
Not use the MIA cache at all, instead going to origin and saving that in IAD
Something else?

ErisaOP•12/29/23, 2:03 AM

It depends on what toplogy its using (which for smart is dynamically determined), I couldnt speak to it with any certainty

ErisaOP•12/29/23, 2:04 AM

But if MIA was one of the colos in the toplogy and it was working optimally then yes it would pull it

ErisaOP•12/29/23, 2:05 AM

You may also see in logs a

UpperTierColoID

UpperTierColoID

which will tell you which other colo the cache was fetched from, if not the local one

dave•12/29/23, 2:07 AM

This is B2's IP. So does that mean my requests are already being cached in IAD?

ErisaOP•12/29/23, 2:09 AM

Yeah. IAD will store cache and other colos will request copies from IAD if they dont have any locally

ErisaOP•12/29/23, 2:10 AM

A generic topology would store the cache in more places but would need more origin requests in order to fill them

ErisaOP•12/29/23, 2:11 AM

Also worth noting since you have regional tier enabled its a lot more nuanced than that, theres various tiers in the middle before it gets to IAD

ErisaOP•12/29/23, 2:12 AM

as a simplified example if you hit a colo on the west coast of the US and it didnt have cache but a regional tier on the west coast did, it can avoid a request to IAD all the way over in the east by taking it from that nearby regional tier

ErisaOP•12/29/23, 2:13 AM

which keeps latency down

ErisaOP•12/29/23, 2:14 AM

Smart + Regional is a very powerful combination if your goal is to maximise cache hit rate

EErisa Smart + Regional is a very powerful combination if your goal is to maximise cach...

dave•12/29/23, 2:19 AM

nice! from what you described, sounds like I'm worrying bout nothing

EErisa cf-worker will never work in rules

dave•12/29/23, 2:21 AM

Is there really no way to detect if something is or isn't a Worker subrequest?

ErisaOP•12/29/23, 2:21 AM

I mean I would have expected

cf.worker.upstream_zone

cf.worker.upstream_zone

to be supported but if it isnt then no

ErisaOP•12/29/23, 2:21 AM

That property exists to be used in lieu of cf-worker

EErisa Did a quick test to confirm and it impacts serving as well, if you dont match th...

dave•12/29/23, 2:45 AM

Another question! If I set

"Cache-Control": "no-cache, no-store, no-transform"

"Cache-Control": "no-cache, no-store, no-transform"

on my fetch request in a Worker, will that bypass the Cache Rules?

dave•12/29/23, 2:51 AM

✘ [ERROR]   Error: Promise will never complete.

✘ [ERROR]   Error: Promise will never complete.

What logic triggers this? I have a setTimeout used for polling that increases on every attempt.

kian•12/29/23, 2:56 AM

Most of the errors around scripts never returning a response or promises never completing means there’s stuff being used in the global scope

kian•12/29/23, 2:57 AM

The runtime can only see what was created in that request - so if Request B is depending on a global Promise from Request A then it sees that nothing is left in Request B yet it hasn’t returned a response.

kian•12/29/23, 2:57 AM

That’s usually a different error though, “script will never return a response” or similar.

Kkian Most of the errors around scripts never returning a response or promises never c...

dave•12/29/23, 3:13 AM

odd... I added some more logging, maybe I missed a throw or something on my promise.

dave•12/29/23, 3:13 AM

didn't think I had anything in my globals that would cause it

Kkian Nope

dave•12/29/23, 3:22 AM

thank you, it's working great for all my JSON files in this bucket!

Pretty big data savings, since this is/was all uncompressed text before.

kian•12/29/23, 3:23 AM

I guess a theoretical downside that isn’t specific to S3 or R2 is that you might lose Content-Length if on-the-fly decompression is needed.

kian•12/29/23, 3:23 AM

If you don’t need that header then it’s fine.

The threat model is pretty low for that because the worker has to be running on your zone to begin w

Similar Threads

Similar Threads

Similar Threads