Thank you for your answer 🙏The page functions is just a astro page in SSR. So if i get a lot of req

Thank you for your answer

The page functions is just a astro page in SSR. So if i get a lot of requests my website can be inaccessible ?

Joy•3/3/24, 5:58 PM

Hello everyone
I have a few endpoints in one of my CF workers. I want if someone hits /endpoint-A, I want to make an API call to the /endpoint-B. Is this possible to implement?
I tried it too, but it returns me this error

Joy•3/3/24, 5:58 PM

Screenshot_2024-03-03_at_11.26.26_PM.png

JJoy Hello everyone I have a few endpoints in one of my CF workers. I want if someone...

Cyb3r-Jak3•3/3/24, 10:35 PM

You probabaly want to use a service bind to make a worker calls itself https://developers.cloudflare.com/workers/configuration/bindings/about-service-bindings/

RRayane Thank you for your answer 🙏The page functions is just a astro page in SSR. So i...

Chaika•3/3/24, 11:17 PM

I wouldn't think a single SSR page would be nearly that high. Are you doing something heavy compute-wise, dependencies, or else?

CChaika I wouldn't think a single SSR page would be nearly that high. Are you doing some...

RayaneOP•3/3/24, 11:28 PM

Just use React and retrieve the query parameters of URL

CoreySeren•3/4/24, 1:10 AM

I got an email that I have exceeded 50% of daily usage limit for Cloudflare Workers KV , can I see a breakdown of what endpoints that is coming from?

CCoreySeren I got an email that I have exceeded 50% of daily usage limit for Cloudflare Work...

Chaika•3/4/24, 4:14 AM

not as far as I know. Can't even break it down per namespace. You'd probably be best looking at worker analytics of workers you know which are using KV, and the specific limit you are exceeding

Original message was deleted

RayaneOP•3/4/24, 6:45 AM

const url = Astro.url;
const params = new URLSearchParams(url.search);
const firstKey = params.entries().next();

AmaraFray•3/4/24, 11:56 AM

Hey guys, how do I prevent http floods on my workers endpoint?

AmaraFray•3/4/24, 12:04 PM

Okay, usually whats the best practices for configuring WAF?

AmaraFray•3/4/24, 12:06 PM

I'll give a bit more context, I have a mobile application, who's backend is entirely serverless on workers.

Ideally I'm not expecting to go beyond the workers paid plan of 10$ for the first year, but still would like to be open to scaling. It is connected to my (api.*) subdomain

AmaraFray•3/4/24, 12:07 PM

im not worried about authentication issues or such, but what I am worried about is someone pinging the server a million times and driving up my request counts

AmaraFray•3/4/24, 12:07 PM

I currently am using WAF to block access to anything that's not a valid endpoint

AmaraFray•3/4/24, 12:08 PM

(I should mention it's my first time worrying about things like this so I might be missing something very obvious, please do just share resources if i have to do some reading)

AAmaraFray I'll give a bit more context, I have a mobile application, who's backend is enti...

Hello, I’m Allie!•3/4/24, 12:17 PM

You need to identify what could separate a real user from an unwanted bot/crawler. This is a bit more difficult, issuing to the fact you don't want to(and probably can't) spawn a captcha in response to an interaction. If your app only operates in certain regions, block all other regions. If your app is only to be used on client devices, block datacenter IPs.

HHello, I’m Allie!You need to identify what could separate a real user from an unwanted bot/crawle...

AmaraFray•3/4/24, 12:19 PM

Alright, firebase has something called app check? is there something similar for cloudflare i could implement?

AAmaraFray Alright, firebase has something called app check? is there something similar for...

Hello, I’m Allie!•3/4/24, 12:20 PM

Not by ddefault, though you may be able to build something similar with WAF rules manually

HHello, I’m Allie!Not by ddefault, though you **may** be able to build something similar with WAF ...

AmaraFray•3/4/24, 12:51 PM

Okayy I'll try to research into that, any resources i can look at?

AAmaraFray Okayy I'll try to research into that, any resources i can look at?

Hello, I’m Allie!•3/4/24, 12:52 PM

Maybe https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/ ?

The Cloudflare Blog

Private Access Tokens: eliminating CAPTCHAs on iPhones and Macs wit...

Today we’re announcing Private Access Tokens, a completely invisible, private way to validate that real users are visiting your site.

Hello, I’m Allie!•3/4/24, 12:52 PM

Don't know if they actually cover implementation there

AmaraFray•3/4/24, 12:52 PM

thank youu, will look at it!

HHello, I’m Allie!You need to identify what could separate a real user from an unwanted bot/crawle...

AmaraFray•3/4/24, 12:53 PM

also how can I go about blocking datacenter IPs?

AAmaraFray also how can I go about blocking datacenter IPs?

Hello, I’m Allie!•3/4/24, 12:54 PM

You could find the Autonomous System Number of the big datacenter providers, and block by them?

Autonomous system (Internet)

An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain, that presents a common and clearly defined routing policy to the Internet. Each AS is assigned an autonomous system number (ASN), for use in Borde...

AmaraFray•3/4/24, 12:55 PM

okay alright! So this all has to be hardcoded into the WAF expression correct?

AAmaraFray okay alright! So this all has to be hardcoded into the WAF expression correct?

Hello, I’m Allie!•3/4/24, 12:56 PM

No, at least not for Enterprise Customers: https://developers.cloudflare.com/waf/tools/lists/custom-lists/#lists-with-asns

Cloudflare Docs

Custom lists · Cloudflare Web Application Firewall (WAF) docs

A custom list contains one or more items of the same type (for example, IP addresses, hostnames, or ASNs) that you can reference collectively, by …

HHello, I’m Allie!No, at least not for Enterprise Customers: https://developers.cloudflare.com/waf...

AmaraFray•3/4/24, 12:57 PM

ah, cries in not enterprise thanks anyways!

AAmaraFray _ah, cries in not enterprise_ thanks anyways!

Hello, I’m Allie!•3/4/24, 12:58 PM

You can also block IPs/ranges

TTaurlon Could you foresee any negative implications of doing this? For example, legitima...

Hello, I’m Allie!•3/4/24, 12:59 PM

Maybe? If you block a regional ISP, then there is probably going to be issues. If the endpoint you are protecting is only ever meant to be accessed by mobile devices, then it should be reasonably safe to block datacenter IPs

Hello, I’m Allie!•3/4/24, 12:59 PM

There's always the risk that a user is using a VPS as a VPN, and thus will get blocked

Hello, I’m Allie!•3/4/24, 12:59 PM

But no security policy is perfect

AmaraFray•3/4/24, 1:00 PM

would this work? https://community.cloudflare.com/t/blocking-datacenters/317059

AAmaraFray would this work? https://community.cloudflare.com/t/blocking-datacenters/317059

Hello, I’m Allie!•3/4/24, 1:01 PM

Maybe? It would prevent registered bots from being blocked, but that still doesn't preclude someone running a small VPS

Hello, I’m Allie!•3/4/24, 1:01 PM

Which would be blocked

HHello, I’m Allie!Maybe? It would prevent registered bots from being blocked, but that still doesn...

AmaraFray•3/4/24, 1:02 PM

that's a downside im willing to live with, thank you so much!

TTaurlon Per your follow-up comment, would those same risks apply to blocking IPs/ranges?

Hello, I’m Allie!•3/4/24, 1:03 PM

Sort of? It depends on how you collect the IPs in question

Hello, I’m Allie!•3/4/24, 1:03 PM

And also whether those IPs are shared across multiple tasks/users

HHello, I’m Allie!Maybe https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using...

AmaraFray•3/4/24, 1:09 PM

the implementation seems to be to use Turnstile? Is that what it is supposed to be or am I going down the wrong path?

AAmaraFray the implementation seems to be to use Turnstile? Is that what it is supposed to ...

Hello, I’m Allie!•3/4/24, 1:11 PM

You could do that? The Personal Access Token specifically only works on Apple devices, but Turnstile as a whole should work on anything with a mondern/standard-ish browser

HHello, I’m Allie!You could do that? The Personal Access Token specifically only works on Apple de...

AmaraFray•3/4/24, 1:11 PM

is it possible to integrate Turnstile onto mobile applications, dart to be specific?

AAmaraFray is it possible to integrate Turnstile onto mobile applications, dart to be speci...

Hello, I’m Allie!•3/4/24, 1:12 PM

You would have to embed it in a WebView. Atm I don't see a package for it on pub.devpub.dev, so you would have to do it yourself

HHello, I’m Allie!You would have to embed it in a WebView. Atm I don't see a package for it on `pu...

AmaraFray•3/4/24, 1:14 PM

yeah that's what I thought, I'll try to find alternatives till then. All workers are susceptible to flooding right? Does everyone just block datacenters and hope that no one else spams their server?

AmaraFray•3/4/24, 1:16 PM

a simple script like

for i in range(n):
  requests.get("x.y.z")

for i in range(n):
  requests.get("x.y.z")

is a threat?

kian•3/4/24, 1:19 PM

There are half a dozen different protections.

kian•3/4/24, 1:20 PM

Rate limiting is unmetered and free, as is the WAF.

kian•3/4/24, 1:20 PM

If you have an endpoint that expects an

Authorization

Authorization

header, you can reject requests without it in the WAF rather than your Worker and then your Worker would never be invoked for those requests.

kian•3/4/24, 1:21 PM

If you don't want them to be able to make more than 100 requests a minute, you can add that for free in rate limiting.

AmaraFray•3/4/24, 1:24 PM

Yeah this is the set up I have currently, apart from this is there anything I can do?

Jadugar_Jaggu•3/4/24, 2:20 PM

hey guys is anyone familiar with this issue? I am facing it right after automatic migration of my workers to standard pricing model
https://community.cloudflare.com/t/workers-unbound-has-not-yet-been-enabled-for-this-account/623732

Thank you for your answer 🙏The page functions is just a astro page in SSR. So if i get a lot of req

Similar Threads

Similar Threads

Similar Threads