Cloudflare Developers•2y ago

Maybe? It would prevent registered bots from being blocked, but that still doesn't preclude someone

Maybe? It would prevent registered bots from being blocked, but that still doesn't preclude someone running a small VPS

Hello, I’m Allie!OP•3/4/24, 1:01 PM

Which would be blocked

HHello, I’m Allie!Maybe? It would prevent registered bots from being blocked, but that still doesn...

AmaraFray•3/4/24, 1:02 PM

that's a downside im willing to live with, thank you so much!

TTaurlon Per your follow-up comment, would those same risks apply to blocking IPs/ranges?

Hello, I’m Allie!OP•3/4/24, 1:03 PM

Sort of? It depends on how you collect the IPs in question

Hello, I’m Allie!OP•3/4/24, 1:03 PM

And also whether those IPs are shared across multiple tasks/users

HHello, I’m Allie!Maybe https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using...

AmaraFray•3/4/24, 1:09 PM

the implementation seems to be to use Turnstile? Is that what it is supposed to be or am I going down the wrong path?

AAmaraFray the implementation seems to be to use Turnstile? Is that what it is supposed to ...

Hello, I’m Allie!OP•3/4/24, 1:11 PM

You could do that? The Personal Access Token specifically only works on Apple devices, but Turnstile as a whole should work on anything with a mondern/standard-ish browser

HHello, I’m Allie!You could do that? The Personal Access Token specifically only works on Apple de...

AmaraFray•3/4/24, 1:11 PM

is it possible to integrate Turnstile onto mobile applications, dart to be specific?

AAmaraFray is it possible to integrate Turnstile onto mobile applications, dart to be speci...

Hello, I’m Allie!OP•3/4/24, 1:12 PM

You would have to embed it in a WebView. Atm I don't see a package for it on pub.devpub.dev, so you would have to do it yourself

HHello, I’m Allie!You would have to embed it in a WebView. Atm I don't see a package for it on `pu...

AmaraFray•3/4/24, 1:14 PM

yeah that's what I thought, I'll try to find alternatives till then. All workers are susceptible to flooding right? Does everyone just block datacenters and hope that no one else spams their server?

AmaraFray•3/4/24, 1:16 PM

a simple script like

for i in range(n):
  requests.get("x.y.z")

for i in range(n):
  requests.get("x.y.z")

is a threat?

kian•3/4/24, 1:19 PM

There are half a dozen different protections.

kian•3/4/24, 1:20 PM

Rate limiting is unmetered and free, as is the WAF.

kian•3/4/24, 1:20 PM

If you have an endpoint that expects an AuthorizationAuthorization header, you can reject requests without it in the WAF rather than your Worker and then your Worker would never be invoked for those requests.

kian•3/4/24, 1:21 PM

If you don't want them to be able to make more than 100 requests a minute, you can add that for free in rate limiting.

AmaraFray•3/4/24, 1:24 PM

Yeah this is the set up I have currently, apart from this is there anything I can do?

Jadugar_Jaggu•3/4/24, 2:20 PM

hey guys is anyone familiar with this issue? I am facing it right after automatic migration of my workers to standard pricing model
https://community.cloudflare.com/t/workers-unbound-has-not-yet-been-enabled-for-this-account/623732

vakno•3/4/24, 2:51 PM

I have multiple "children workers" that use HTMLRewriter() to change the HTML of response.
What I am trying to achieve is to trigger multiple workers with "parent worker".
I know you can use service bindings to bind another worker to it, but the problem I have is I need to run multiple workers and modify the responses accordingly.

For example: if I bind two child workers, one will change meta title (worker 1) and one meta description (worker 2).
What I need to achieve is firstly trigger worker1 with parent request, and then trigger worker 2 on response i get from worker 1, so i get all the HTML changes.

I have no problem getting response from worker 1, but I dont know how to combine worker 1 and worker 2 changes. What i tried is passing body of response from worker 1 to worker 2 fetch, like this:

    // Fetch the resource using childWorker1
    const childWorker1Response = await env.childWorker1.fetch(request.clone());

    // Fully consume the response body of childWorker1
    const childWorker1ResponseBody = await childWorker1Response.text();

    // Fetch a resource using childWorker2, passing the response body of childWorker1 as the POST body
    const childWorker2Response = await env.childWorker2.fetch(request.clone(), {
      method: 'POST',
      body: childWorker1ResponseBody
    });

    // Fetch the resource using childWorker1
    const childWorker1Response = await env.childWorker1.fetch(request.clone());

    // Fully consume the response body of childWorker1
    const childWorker1ResponseBody = await childWorker1Response.text();

    // Fetch a resource using childWorker2, passing the response body of childWorker1 as the POST body
    const childWorker2Response = await env.childWorker2.fetch(request.clone(), {
      method: 'POST',
      body: childWorker1ResponseBody
    });

But this does not seem to work.

Do you have any ideas what is wrong?
Any help would be greatly appreciated!

Vvakno I have multiple "children workers" that use HTMLRewriter() to change the HTML of...

Hello, I’m Allie!OP•3/4/24, 3:03 PM

Is there any reason why this couldn’t be a single Worker?

HHello, I’m Allie!Is there any reason why this couldn’t be a single Worker?

vakno•3/4/24, 3:05 PM

yes because i will need multiple workers to run with this parent workers on different urls. There would be too many combinations to handle

vakno•3/4/24, 3:13 PM

if i have 5 different child workers there will be 120 permutations

vakno•3/4/24, 3:13 PM

this is way too much to track and keep it organised

Vvakno yes because i will need multiple workers to run with this parent workers on diff...

Hello, I’m Allie!OP•3/4/24, 3:16 PM

I’m not sure I understand. Can you give me an example?

Vvakno I have multiple "children workers" that use HTMLRewriter() to change the HTML of...

Jadugar_Jaggu•3/4/24, 3:18 PM

i think instead of using request.clone() Just use request directly

Jadugar_Jaggu•3/4/24, 3:19 PM

so it will work as many times as you want

JJadugar_Jaggu i think instead of using request.clone() Just use request directly

Hello, I’m Allie!OP•3/4/24, 3:19 PM

That still wouldn’t combine the changes though

Hello, I’m Allie!OP•3/4/24, 3:19 PM

Only make two separate copies, and modifying both slightly

HHello, I’m Allie!I’m not sure I understand. Can you give me an example?

vakno•3/4/24, 3:21 PM

ok so i have 100 urls, on some i need to change meta titles, on some i need to change meta description, on some i need to change both, on some i need to change h1 to h2 and so on. I have like 6 seperate html changes i need to change on different urls.

If i want to make workers that cover all combinations i would need to create 720 different workers.

Vvakno ok so i have 100 urls, on some i need to change meta titles, on some i need to c...

Hello, I’m Allie!OP•3/4/24, 3:22 PM

Exactly, so why not a single Worker that does everything?

HHello, I’m Allie!Exactly, so why not a single Worker that does everything?

Jadugar_Jaggu•3/4/24, 3:23 PM

how you will use htmlrewriter to parse html and store it in a var?

I think we can only store a htmlrewriter response if we use it in a service worker and make a hit from parent

Jadugar_Jaggu•3/4/24, 3:24 PM

is there another way of doing it?

JJadugar_Jaggu how you will use htmlrewriter to parse html and store it in a var? I think we ...

Hello, I’m Allie!OP•3/4/24, 3:25 PM

Why would you need to store it? Why not just stream it back to the client once it has been modified?

HHello, I’m Allie!Why would you need to store it? Why not just stream it back to the client once i...

Jadugar_Jaggu•3/4/24, 3:26 PM

it depends on the use cases. Maybe he doesn't want to stream it to the client.

Cloudflare workers are very powerful, can do many things with it

HHello, I’m Allie!Exactly, so why not a single Worker that does everything?

vakno•3/4/24, 3:36 PM

because the implementation would look much cleaner and organized code wise, also i think there might be problems with some responses

Vvakno because the implementation would look much cleaner and organized code wise, also...

Hello, I’m Allie!OP•3/4/24, 3:42 PM

I would note too that this will cost more, since you would have to invoke 2+ Workers

HHello, I’m Allie!I would note too that this will cost more, since you would have to invoke 2+ Wor...

vakno•3/4/24, 3:46 PM

you are right. So basically the best solution is to combine all into one?

Vvakno you are right. So basically the best solution is to combine all into one?

Hello, I’m Allie!OP•3/4/24, 3:51 PM

Imo, yes. It should also make it (marginally) faster

Rahul Raikwar•3/4/24, 4:06 PM

How can fix this - Error: Failed to publish your Function. Got error: Your Functions script is over the 1 MiB size limit (workers.api.error.script_too_large)

Vvakno ok so i have 100 urls, on some i need to change meta titles, on some i need to c...

Isaac McFadyen•3/4/24, 4:07 PM

There's also a limit of 100 workers on an account so you actually couldn't do this without Workers for Platforms (which generally requires an Enterprise plan).

Isaac McFadyen•3/4/24, 4:07 PM

And I don't think you could bind 720 workers without WfP even if you could create them all.

RRahul Raikwar How can fix this - Error: Failed to publish your Function. Got error: Your Funct...

Chaika•3/4/24, 4:11 PM

Either make your script smaller, or upgrade to Workers Paid which is 10 MiB max

Chaika•3/4/24, 4:11 PM

You're using nextjs or some framework?

Mitya•3/4/24, 4:15 PM

Hey all. If I have a shared JS file, let's say global.jsglobal.js, containing a

{}

{}

, which multiple scripts import and hook things onto, will this leak/bleed into multiple requests to my worker given Node's import caching, or will it be isolated to just the current request?

MMitya Hey all. If I have a shared JS file, let's say `global.js`, containing a `{}`, w...

Isaac McFadyen•3/4/24, 4:22 PM

When Workers are deployed the files are bundled automatically into each Worker, they're not actually imported at runtime. So to answer your question, they'll be completely isolated for each Worker.

However they won't be isolated by each request - if you mutate a variable then that variable will stay mutated on the next request if the user hits the same server, which is likely if the user is the same but is unlikely if two different users or even different browsers are requesting the Worker.

CChaika You're using nextjs or some framework?

Rahul Raikwar•3/4/24, 4:25 PM

Yes next js

IIsaac McFadyen When Workers are deployed the files are bundled automatically into each Worker, ...

Mitya•3/4/24, 4:26 PM

Thanks for the advice, much appreciated. If the leakage occurs within multiple requests for the same user, that's fine, but you're saying I can rely on non-leakage between different users?

Basically my use case is that a request sends a QS param, let's say foo=1foo=1, and I want to hook that onto a global object so other files can use it, rather than laboriously having to pass it around to all functions. But the next request may send QS foo=2foo=2. Sounds like I'll be OK based on what you say. (But presumably in a non-serverless/Worker environment this would be problematic?)

MMitya Thanks for the advice, much appreciated. If the leakage occurs within multiple r...

Hello, I’m Allie!OP•3/4/24, 4:29 PM

You can’t be guaranteed that it will/won’t ever leak

MMitya Thanks for the advice, much appreciated. If the leakage occurs within multiple r...

Isaac McFadyen•3/4/24, 4:29 PM

So basically a global variable is stored per server (called a "metal"). Cloudflare has many many metals so it's unlikely that one user will hit the same metal, but it's very much possible especially in smaller datacenters with only a few metals. I'd not rely on users hitting different metals and just write any code with the idea that it might leak between users if they hit the same metal.

Chaika•3/4/24, 4:31 PM

(the other way I'd view it is eventually if you scale up/become big enough it's going to happen more and more, unlikely at small scale sure but still bad idea)

Mitya•3/4/24, 4:32 PM

Interesting - thanks very much. So if I can't hook things onto a global object, for the reasons you guys have said, is my only remaining option to explicitly pass around info between concerns (middleware/controllers/helpers) or is there some other way I'm missing?

Maybe? It would prevent registered bots from being blocked, but that still doesn't preclude someone

Similar Threads

Similar Threads

Similar Threads