a cloudflare employee with unrestricted server access can just read `/proc/[pid]/mem` . That said,

a cloudflare employee with unrestricted server access can just read

/proc/[pid]/mem

/proc/[pid]/mem

/proc/[pid]/mem

/proc/[pid]/mem .

That said, the number of people with that kind of access is very small.

Isaac McFadyen•1/29/24, 9:02 PM

It's still going to be fast though. Just not as fast.

Ddave a cloudflare employee with unrestricted server access can just read `/proc/[pid]...

Isaac McFadyen•1/29/24, 9:03 PM

True! But at that point it becomes a "who do you trust" kinda thing.

Isaac McFadyen•1/29/24, 9:04 PM

If you had an OVH box they could do the same, or an AWS EC2 VM or Lambda... etc.

CChaika you could have a transform rule modify request header and include it:

daveOP•1/29/24, 9:10 PM

where is cf.zone.namecf.zone.name documented again? Trying to see what else I can add

daveOP•1/29/24, 9:10 PM

ah https://developers.cloudflare.com/rules/transform/request-header-modification/reference/fields-functions/

Available fields and functions for HTTP request header modification...

The available fields when setting an HTTP request header value using an expression are the following:

Ddave where is `cf.zone.name` documented again? Trying to see what else I can add

Chaika•1/29/24, 9:11 PM

yea some are there and not on the overall page, and some aren't on either

daveOP•1/29/24, 9:13 PM

what's the diff between cf.worker.upstream_zonecf.worker.upstream_zone and cf.zone.namecf.zone.name?

Chaika•1/29/24, 9:13 PM

Identifies whether a request comes from a worker or not.

When a request comes from a worker, this field will hold the name of the zone for that worker. Otherwise cf.worker.upstream_zone is empty.

Chaika•1/29/24, 9:14 PM

it should be that if a worker running on cookies.com fetches pineapple.org, and you were running this transform rule/etc on pineapple.org cf.zone.name would be pineapple.org, and upstream_zone would be cookies.com

daveOP•1/29/24, 9:17 PM

'cf.worker.upstream_zone' is not a valid value for expression because the use of field cf.worker.upstream_zone is not allowed (Code: 20087)

daveOP•1/29/24, 9:17 PM

right, also can't do that lol

Ddave where is `cf.zone.name` documented again? Trying to see what else I can add

Chaika•1/29/24, 9:17 PM

if you're just looking for useful headers to add, I would add
cf.colo.id <- id of colo, unique for cache
cf.metal.id <- unique metal id in that colo
cf.zone.name

CChaika if you're just looking for useful headers to add, I would add cf.colo.id <- id o...

daveOP•1/29/24, 9:18 PM

anything else?

Chaika•1/29/24, 9:19 PM

The convention of adding x-x- for custom headers is gone/deprecated and the fact those are uppercase also hurts

Chaika•1/29/24, 9:19 PM

I think you could get the worker via http.request.headers["cf-worker"][0]http.request.headers["cf-worker"][0], not sure if it would be set that point though hmm

CChaika The convention of adding `x-` for custom headers is gone/deprecated and the fact...

daveOP•1/29/24, 9:20 PM

what's wrong with the uppercase?

Aren't they converted anyway? I see them as lowercase in my Worker logs

kian•1/29/24, 9:20 PM

HTTP/2 lowercases them

CChaika I think you could get the worker via `http.request.headers["cf-worker"][0]`, not...

daveOP•1/29/24, 9:21 PM

doesn't seem to do anything

Chaika•1/29/24, 9:21 PM

are you requesting it via a worker?

daveOP•1/29/24, 9:21 PM

Chaika•1/29/24, 9:22 PM

I mean that would already be passed to your origin in the cf-worker header anyway if that's a request header rule

CChaika The convention of adding `x-` for custom headers is gone/deprecated and the fact...

daveOP•1/29/24, 9:23 PM

I do the x-x- so these headers stand out, and we don't use x-x- in any of our applications (so this avoids ever having an accidental conflict of header names)

Chaika•1/29/24, 9:23 PM

I think you have most of the useful stuff though, you could grab the edge client port for fun if you wanted too cf.edge.client_portcf.edge.client_port, something you can only get by passing it down.

daveOP•1/29/24, 9:23 PM

I'll make them lower case though, good point

CChaika I think you have most of the useful stuff though, you could grab the edge client...

daveOP•1/29/24, 9:24 PM

good idea, added!

daveOP•1/29/24, 9:24 PM