Is there any way to protect the contents of both the Worker and the KV data on a client site? There'

Is there any way to protect the contents of both the Worker and the KV data on a client site? There's some proprietary data we want fast access to, so were using KV to store, but ideally it would be something that isn't public (even though it's the Client's Cloudflare account)

Ddave If I return even just 1 bytes, that will “reset” my 100 second timeout, right?

dave•4/23/24, 12:12 PM

My idea is to try returning whitespaces until the response is ready.

CColin Asquith Is there any way to protect the contents of both the Worker and the KV data on a...

Hello, I’m Allie!•4/23/24, 12:14 PM

Not really. Anything on their Cloudflare account is theirs to see. You could call out to an external API to get the data, but the data will still be in their hands at some point

HHello, I’m Allie!Not really. Anything on their Cloudflare account is theirs to see. You could cal...

Colin AsquithOP•4/23/24, 12:19 PM

If the external API was also Cloudflare, would it mean it could be very fast? The benefit of it being within the client account is performance and it’s straightforward, there’s some data we would like to add that it’s better if it’s not all public so may look at how to do this or obfuscate it a bit

CColin Asquith If the external API was also Cloudflare, would it mean it could be very fast? Th...

Hello, I’m Allie!•4/23/24, 12:25 PM

Sure, it should be pretty fast. Just keep in mind that any data that reaches the Client's Worker is theoretically something they have access to

naourass•4/23/24, 1:14 PM

I have a question regarding protection against denial of wallet for public worker/function endpoints. In case an attacker found some way to get thousand of ip addresses and used them to send billions of requests to the public endpoint (which is quite common these days), what are some possible approaches/implementations that could turn off your worker automatically if a monthly threshold is exceeded (the threshold could be either the global number of requests or a specific bill amount)?

I believe that in such a scenario for an organisatiton with limited funds, the only thing that you can do is turn off the worker and the availability of its online service (since the bill amount has exceeded you budget or bank account balance). Please correct me if there's other strategies to handle this.

HHello, I’m Allie!Sure, it should be pretty fast. Just keep in mind that any data that reaches the...

Colin AsquithOP•4/23/24, 1:27 PM

Understood, I know it’s something they would be able to see but for the use case it’s slightly better if they don’t have all of the data together, both to protect it but also for updates so we would control data in one place rather than multiple KVs, I’ll look into it!

Original message was deleted

naourass•4/23/24, 3:32 PM

Oh that would be nice, is there any official documentation for that?

Original message was deleted

naourass•4/23/24, 3:35 PM

It is, but that doesn't mean I wouldn't have to pay the bill if the attacker succeded the ddos...

Nnaourass It is, but that doesn't mean I wouldn't have to pay the bill if the attacker suc...

Beny•4/23/24, 3:41 PM

Actually they take off any legitimate ddoses from your bill

BBeny Actually they take off any legitimate ddoses from your bill 😄

naourass•4/23/24, 3:43 PM

This would be awesome from Cloudflare, but is there any official reference for this that I can share with my collaborators?

Nnaourass This would be awesome from Cloudflare, but is there any official reference for t...

Beny•4/23/24, 3:44 PM

There's only this message from someone with a role in the server here, it's more of a support policy they have than an official "feature" that would be documented.
https://discord.com/channels/595317990191398933/909458221419356210/1041778929654055026

Beny•4/23/24, 3:46 PM

All account analytics are accessible over GraphQL if you wanted to build your own kill-switch too: https://developers.cloudflare.com/analytics/graphql-api/

Cloudflare Docs

GraphQL Analytics API · Cloudflare Analytics docs

The GraphQL Analytics API provides data regarding HTTP requests passing through Cloudflare’s network, as well as data from specific products, such as …

Beny•4/23/24, 3:49 PM

This is on their site too under the DDoS Page

BBeny There's only this message from someone with a role in the server here, it's more...

naourass•4/23/24, 3:56 PM

Thanks a lot for the information

Murmeltier•4/23/24, 8:29 PM

Is workers for plattforms already available as a pay-as-you-go option? Docs are still talking about that happening "on April 16th". :|

MMurmeltier Is workers for plattforms already available as a pay-as-you-go option? Docs are ...

Chaika•4/23/24, 8:50 PM

yep, should be on the left bar: https://dash.cloudflare.com/?to=/:account/workers-for-platforms

Chaika•4/23/24, 8:50 PM

#workers-for-platforms

Chaika•4/23/24, 8:50 PM

workers-for-platforms

CChaika yep, should be on the left bar: https://dash.cloudflare.com/?to=/:account/worker...

Murmeltier•4/23/24, 8:51 PM

omg totally missed that, thx!

Ottomated•4/23/24, 9:59 PM

It seems like there's a pretty drastic deviation from the URL spec that might be a recent change?

new URLSearchParams({ 'a[]': 'b' }).toString()new URLSearchParams({ 'a[]': 'b' }).toString() should be a%5B%5D=ba%5B%5D=b according to the URL spec, but as you can see here it does not escape the param names

Adding the url_originalurl_original compat flag fixes this, but that was changed in 2022 and this has started breaking my apps only recently.

OOttomated It seems like there's a pretty drastic deviation from the URL spec that might be...

Unsmart•4/23/24, 10:19 PM

Hmm interesting. Did you happen to change a compat date or any other flags or did it start erroring without any changes on your end?

UUnsmart Hmm interesting. Did you happen to change a compat date or any other flags or di...

Ottomated•4/23/24, 10:20 PM

I didn't even make a new deployment

Unsmart•4/23/24, 10:20 PM

I see thats quite bad I will see if I can escalate that issue

Ottomated•4/23/24, 10:21 PM

Although it's possible that the external API that's throwing an error because of this was lenient before

Ottomated•4/23/24, 10:21 PM

so can't pin it down exactly

Ottomated•4/23/24, 10:22 PM

it started happening sometime around the 19th

Unsmart•4/23/24, 10:25 PM

Ah I see so the issue might be a result of an api change to a 3rd party unrelated to cloudflare?

kian•4/23/24, 11:33 PM

ada-url was bumped to 2.7.8 2 weeks ago (11/04) so if that has just hit production then there could be a regression there

kian•4/23/24, 11:33 PM

(workerd uses ada-url when using url_standard)

kian•4/23/24, 11:33 PM

kian•4/23/24, 11:34 PM

Looks like it's fixing that regression where it didn't escape them - https://github.com/cloudflare/workerd/pull/2008/files#diff-9890fee256b551c112b657b7d25a5d7003705caddf3df8ff7ef1afe17813b340

kian•4/23/24, 11:39 PM

It's possible that hasn't hit production yet, so you're seeing the bad behaviour from before the ada-url bump.

UUnsmart Ah I see so the issue might be a result of an api change to a 3rd party unrelate...

Ottomated•4/23/24, 11:45 PM

no, but the issue might have been hidden before if the 3rd party api is no longer accepting invalid url encoding that they once did

kian•4/23/24, 11:47 PM

It's fixed in workerd, likely just waiting for a rollout.

kian•4/23/24, 11:47 PM

@jasnell_ or @kenton might be able to give more insight into that.

Ottomated•4/23/24, 11:50 PM

great to hear, have something dependent on this scheduled for this Friday so would love if there's insight on when that rollout will happen

kian•4/23/24, 11:53 PM

cc @Brendan Irvine-Broque too - hopefully one of them can give you a better answer

kian•4/24/24, 12:00 AM

Thanks James!

Mitya•4/24/24, 10:54 AM

I keep asking here, but keep getting ignored. Could someone from CF PLEASE respond to these two mothballed threads I raised? I would be most grateful:

MMitya I keep asking here, but keep getting ignored. Could someone from CF PLEASE respo...

Hello, I’m Allie!•4/24/24, 11:12 AM

Do you have a repo you can share?

Johan•4/24/24, 1:01 PM

Hey all, I'm stuck on the following. I'm running a local API made accesible via CF tunnel, and linked to a subdomain in the DNS. All works fine, postman works fine. Now when I try to fetch it in a CF worker/page it just times out. From reading up I see that fetching other workers in the same domain can cause problems and that's why service bindings where introduced. But that's where I get stuck. I'm not sure how to bind my tunnel to my page so I can access the API endpoint from my page/worker. Any pointers highly appreciated (new to most of this).

JJohan Hey all, I'm stuck on the following. I'm running a local API made accesible via ...

IEatBeans•4/24/24, 4:39 PM

It sounds like the api is hosted locally, and just tunneled through CF network. I don’t think service bindings are for that, I think that’s for directly calling functions in other workers

JJohan Hey all, I'm stuck on the following. I'm running a local API made accesible via ...

Chaika•4/24/24, 4:41 PM

From reading up I see that fetching other workers in the same domain can cause problems and that's why service bindings where introduced

A Tunnel isn't a worker though, unless you have another worker in front of it or anything?
You're fetching the subdomain right, and not the raw cfargotunnel hostname?

Johan•4/24/24, 4:44 PM

Agreed, been reading up in the meantime too. So my focus is not on that.
Here's to workflow I''m trying to achieve: (pseudo names)

User uploads a file with a client side POST request using XMLHttpRequest to -> example.com/api/files
example.com/api/files does in turn do POST request to tunnel.example.com/localapi/files

I call the tunneled api like so:

await fetch("http://tunnel.example.com/localapi/files", {
                method: "POST", etc

await fetch("http://tunnel.example.com/localapi/files", {
                method: "POST", etc

not using the cfargotunnel, I have dns cname in place.

Chaika•4/24/24, 4:45 PM

should be https (although I'm guessing that's not a straight copy from your code)

not using the cfargotunnel, I have dns cname in place.

cname is proxied right? Do you get the exact error code it returns (ex: 502, 520, etc)

Johan•4/24/24, 4:45 PM

So the weird thing that throws me off is this. If I use postman to call example.com/api/files it works fine files get uploaded to the tunneled API, but when I use XMLHttpRequest call it doesn't. And I don't understand why

Is there any way to protect the contents of both the Worker and the KV data on a client site? There'

Similar Threads

Similar Threads

Similar Threads