hello, when I connect my R2 to domain, it's become publicly accessible, so It's kinda meaningless wh

hello, when I connect my R2 to domain, it's become publicly accessible, so It's kinda meaningless when using presigned url, question: how can I still use presigned url, but disable the public content access without presigned url

coco 🐺•2/17/24, 8:28 PM

Hi all !
I hosted a JSON file on a cloudflare r2 which is updated every 4 minutes by my server. This JSON file is called thousands of times every minute by my users, can you direct me to the least expensive solution to adopt?
Would the cache, for example, allow for fewer class B operations on my r2?

kian•2/17/24, 8:30 PM

Would the cache, for example, allow for fewer class B operations on my r2?

Yes

RRubi hello, when I connect my R2 to domain, it's become publicly accessible, so It's ...

RubiOP•2/17/24, 8:31 PM

even I try to modify the X-Amz-Signature with random, It's still working to access the picture, so the presigned url really has no effect for bucket that connected to domain?

kian•2/17/24, 8:31 PM

Custom domains are always public, they don't use the S3 API or presigned URLs.

Erisa•2/17/24, 8:31 PM

Presigned URLs don't work on custom domains, some alternatives are listed here: https://developers.cloudflare.com/r2/buckets/public-buckets/#access-control

Kkian > Would the cache, for example, allow for fewer class B operations on my r2? Yes

coco 🐺•2/17/24, 8:35 PM

Thank you, and will the cache take into account that the file is updated?

coco 🐺•2/17/24, 8:36 PM

(do I need to add specific rules, or is everything automatic once the cache is activated?)

EErisa Presigned URLs don't work on custom domains, some alternatives are listed here: ...

RubiOP•2/17/24, 8:37 PM

do you have video guide on using WAF with is_timed_hmac_valid_v0 ?

Erisa•2/17/24, 8:37 PM

RubiOP•2/17/24, 8:37 PM

that's ok

Ccoco 🐺Thank you, and will the cache take into account that the file is updated?

Erisa•2/17/24, 8:38 PM

The cache does not know when your file is updated, you need to set a low enough TTL (time to live) or manually purge the cache when you update files.

Ccoco 🐺(do I need to add specific rules, or is everything automatic once the cache is a...

Erisa•2/17/24, 8:38 PM

It will follow the default cache behaviour by default: https://developers.cloudflare.com/cache/concepts/default-cache-behavior/
If you want to change this you can create Cache Rules

EErisa It will follow the default cache behaviour by default: <https://developers.cloud...

coco 🐺•2/17/24, 8:43 PM

Thanks!

EErisa Presigned URLs don't work on custom domains, some alternatives are listed here: ...

RubiOP•2/17/24, 8:49 PM

this need a "Managed Rules" *paying feature ?

RRubi this need a "Managed Rules" *paying feature ?

Hello, I’m Allie!•2/17/24, 8:52 PM

Zero Trust is free, the WAF rule requires Pro+

SoulHarsh007•2/18/24, 7:21 AM

I am using rclone to upload files to my s3 bucket, and today I found this very interesting issue. When I upload files using rclone and it uses multi-part upload, the etag value returned is an invalid md5sum, but if I use singe part uploads, the etag value is a valid md5sum of the uploaded file. is this intentional? I have never seen such behavior with other s3 compatible storage providers. I am attaching a few screenshots for reference, the first one shows etag with multipart upload file, and the second one shows etag with single part / full / no multi part upload.

kian•2/18/24, 7:42 AM

That's how S3 returns the ETag of an object that was uploaded with multipart too.

kian•2/18/24, 7:44 AM

R2's multipart ETag behaviour still differs, regardless of that - you won't be able to checksum the concatentated checksums of the parts with R2 whereas you can with S3.

SoulHarsh007•2/18/24, 7:46 AM

I see, thanks.

miirro7•2/18/24, 5:04 PM

Hi, I'm using presigned URLs to allow users to upload videos directly to R2. It seems my account ID is exposed though, and the docs say to not use the presigned URL on the frontend. Can I still do that, or does exposing my account ID pose a security risk? Thank you for your time

kian•2/18/24, 5:07 PM

Account IDs aren't sensitive, it's fine to show it

pavan5936•2/18/24, 5:09 PM

https://pub-a80818ab28df4e81a125458dc3171d10.r2.dev/8e114fb624d4fbfe09ac69829711f6c32c2a15d88bdc4855b3a29d373f7bf74c%20(3).jpg can we take this link to user directly or can we save this link in db after uploading in r2

miirro7•2/18/24, 5:09 PM

I was just worried, that someone could use my account ID to simply annoy me. e.g. open support requests and ask for a password reset, or sth along those lines

kian•2/18/24, 5:10 PM

Nope, all of that is tied to your email & password.

pavan5936•2/18/24, 5:11 PM

can someone ask help me out

miirro7•2/18/24, 5:12 PM

great to hear kian, thank you so much

Ppavan5936 https://pub-a80818ab28df4e81a125458dc3171d10.r2.dev/8e114fb624d4fbfe09ac69829711...

bun•2/18/24, 5:35 PM

wdym take to user directly?

Ivan Starkov•2/18/24, 5:53 PM

Could anyone explain why tiered caching works with S3 but not with R2? It’s perplexing that to enable tiered caching on Cloudflare with R2, one must resort to using a third-party proxy.

Ivan Starkov•2/18/24, 5:55 PM

How does it understand where is my s3 or proxy origin

Ivan Starkov•2/18/24, 5:57 PM

But why origin location should affect caching. Ordinary caching works, the issue is tiered cache only

Ivan Starkov•2/18/24, 5:58 PM

Simple haproxy out of cloudflare solves the issue, it looks really strange

Original message was deleted

Oleg Isonen•2/18/24, 5:59 PM

What's the right solution for serving static assets over workers? Where are they supposed to be stored to get CDN-like speeds?

bun•2/18/24, 6:01 PM

why is tiered cache even disabled by default ? and what does it being disabled even mean ? does that mean its not cached globally but only in the main datacenter where r2 is at ?

Ivan Starkov•2/18/24, 6:03 PM

Also Im talking about tiered cache but we have enterprise account, same issue for cache reserve with tiered regional caching etc.

Ivan Starkov•2/18/24, 6:05 PM

I know, just can’t get the limitation why there is no cloudflare only way to have regional cache for r2 assets without external services

Original message was deleted

bun•2/18/24, 6:10 PM

how does that increase latency ? if lower tiers need to contact an upper tier thats probably closer than the origin shouldn't that reduce the latency ?

Oleg Isonen•2/18/24, 6:13 PM

@Matt I feel like people are guessing here about what's going on with tiered cache and R2 over workers, maybe you can help us figure this out

OOleg Isonen @Matt I feel like people are guessing here about what's going on with tiered cac...

kian•2/18/24, 6:15 PM

Workers & R2 custom domains all have the same non-Tiered Caching setup, Leo is correct

Unsmart•2/18/24, 6:19 PM

(Also I would refrain from randomly pinging employees here if you want an answer from Cloudflare you can contact support)

OOleg Isonen @Matt I feel like people are guessing here about what's going on with tiered cac...

Erisa•2/18/24, 6:20 PM

Please don't ping staff for questions like this. What Leo said is correct, currently R2 and Tiered Cache are incompatible. This is documented here: https://developers.cloudflare.com/cache/how-to/tiered-cache/#availability

Tiered Cache currently is not compatible with responses from R2. These responses will act as if Tiered Cache is not configured.

IIvan Starkov Also Im talking about tiered cache but we have enterprise account, same issue fo...

Erisa•2/18/24, 6:22 PM

Cache Reserve with R2 data would make no difference since Cache Reserve has the same pricing as R2 and stores your data in R2 behind the scenes.
Since you have an Enterprise account you can talk to Support for specific issues and with your account team if you have any feature requests or questions about product implementations for your use-case.

Ivan Starkov•2/18/24, 6:28 PM

The issue is not price but this -

Regional Tiered Cache provides an additional layer of caching for Enterprise customers who have a global traffic footprint and want to serve content faster by avoiding network latency when there is a cache MISS in a lower-tier, resulting in an upper-tier fetch in a data center located far away. We just want to serve content faster from r2, so It would make difference if it work

Ivan Starkov•2/18/24, 6:29 PM

And from what I see it work with external resources, but not with R2. Its normal question - why

Unsmart•2/18/24, 6:29 PM

Put in a feature request for tiered cache on R2 with your account team. The more requests especially from enterprise customers the more likely it will be prioritized

Ivan Starkov•2/18/24, 6:30 PM

Yep Ill do.

Unsmart•2/18/24, 6:31 PM

The answer as to why is workers. Workers are a global origin and cant work with tiered cache at the moment because it doesnt know what to do.

IIvan Starkov The issue is not price but this - Regional Tiered Cache provides an additional...

Erisa•2/18/24, 6:34 PM

Tiered Cache relies on information about the origin server which currently isn't available in this case because Cloudflare's anycast IP is the origin server. It's a limitation that I'm sure will be worked out in time, and the best way for you to expedite that is to put in a feature request so the team are aware that your company is waiting for this to be addressed.
I definitely feel the pain here as Tiered Cache is a valuable tool for optimising the benefits from cache, so I also hope it can be sorted out soon

Oleg Isonen•2/18/24, 6:39 PM

@Erisa | Support Engineer thank you for your feedback, please tell us how to serve static assets (css/js) from R2 via worker in a way that is fast. What's the official solution here?

We discovered that https://webstudio.is/ is fast on lighthouse and COMPLETELY fails core web vitals specifically because static assets globally are slow (the way we currently serve them), up to 500ms latency

https://pagespeed.web.dev/analysis/https-webstudio-is/pwezpxo8tn

Webstudio

Open visual development for the open web

Similar to Webflow, Webstudio visually translates CSS without obscuring it, giving designers superpowers that were exclusive to developers in the past.

OOleg Isonen @Erisa | Support Engineer thank you for your feedback, please tell us how to ser...

Erisa•2/18/24, 6:47 PM

"is fast" is subjective and hard to make recommendations for, there are many things that can be optimised for that fall outside the control of R2 (e.g. not loading so much JS/CSS, optimizing execution of scripts, all things pointed out on that page)

In terms of serving files from R2, the fastest method is to use the CDN cache either by Custom Domain or by Worker with Cache API: https://developers.cloudflare.com/r2/examples/cache-api/
Yes this will not be as efficient as an external origin with Tiered Cache, however it is the best available with R2 at the moment due to the aforementioned limitations. If the cache is setup fully for all files, the speed will depend on whether the resource is cached in the local datacenter that the user is hitting. The more traffic you get, the faster the site becomes when it relies on cache. Increasing the cache TTL will keep those caches around for longer but increase time to revalidate when you push new updates.

If you are hosting smaller assets you could potentially consider KV or host the whole website on Cloudflare Pages which should be better optimised for web assets. Pages comes with intelligent invalidation of assets when you make a new deploy and has its own internal caching system to keep sites as fast as possible without having a lag to deploy.

There is a guide on choosing a storage product here: https://developers.cloudflare.com/workers/platform/storage-options/

EErisa "is fast" is subjective and hard to make recommendations for, there are many thi...

Oleg Isonen•2/18/24, 6:47 PM

I am specifically talking about latency. Globally its currrently up to 500ms waiting for response from the worker that is trying to get the asset from R2.

hello, when I connect my R2 to domain, it's become publicly accessible, so It's kinda meaningless wh

Similar Threads

Similar Threads

Similar Threads