I'm getting a lot of ` Worker exceeded CPU time limit` errors - is it safe to change from `bundled`

I'm getting a lot of

 Worker exceeded CPU time limit

Worker exceeded CPU time limit

 Worker exceeded CPU time limit

Worker exceeded CPU time limit errors - is it safe to change from

bundled

bundled

bundled

bundled to

Standard

Standard

Standard

Standard? Is there anything that changes other than longer CPU limits?

LukeOP•5/20/24, 10:09 PM

Also, are there any tips to help figure out what code the CPU limits are caused by?

LLuke I'm getting a lot of ` Worker exceeded CPU time limit` errors - is it safe to ch...

kian•5/20/24, 10:17 PM

Limits only go up

kian•5/20/24, 10:17 PM

Subrequests go from 50 to 1,000, CPU time goes from 50ms to 30s, I don't think there's really anything else

LLuke Also, are there any tips to help figure out what code the CPU limits are caused ...

kian•5/20/24, 10:18 PM

There isn't really any good solution for it - you can try timing with

Date.now()

Date.now()

but that is wall time so if you're doing subrequests to websites or bindings then you'd see a long time but the CPU isn't really being used just waiting for a response.

Kkian There isn't really any good solution for it - you can try timing with `Date.now(...

LukeOP•5/20/24, 10:21 PM

Okay I see, thank you. I recall that there was an issue with

Date.now()

Date.now()

not progressing outside of

async

async

methods. Is that still a problem do you know?

kian•5/20/24, 10:21 PM

I meant for local development, Date.now() isn't limited there

kian•5/20/24, 10:22 PM

In deployed Workers it will still only progress on IO

LukeOP•5/20/24, 10:23 PM

Ah ok that makes sense. Thanks for the help

kian•5/20/24, 10:24 PM

Most Workers only really run into CPU issues when parsing a lot of data or stuff like WASM

LukeOP•5/20/24, 10:26 PM

I'm thinking I might be hitting CPU limits with the

HTMLRewrtier

HTMLRewrtier

but having a hard time proving it. Its tough to know when this issue started happening too since the exception causes the worker to crash and not send any logs.

LukeOP•5/20/24, 10:27 PM

I was thinking we could put another worker infront of this worker to detect if there are any issues. Do worker subrequests share the same memory/cpu limits?

Kurzon•5/20/24, 10:31 PM

How can I prevent Cloudflare Workers from counting Unauthorized accesses as requests?

Kurzon•5/20/24, 10:31 PM

I am limited to 100,000 requests per day.

Kurzon•5/20/24, 10:32 PM

But it's not fair because someone can easily attack the website and send 100k requests.

Kurzon•5/20/24, 10:32 PM

So hence why I have an API Key so the website can only be authorized/accessed with it.

Kurzon•5/20/24, 10:32 PM

But it seems that Cloudflare Workers counts unauthorized accesses as requests, so someone can easily spam requests to my Workers site.

Kurzon•5/20/24, 10:32 PM

And hit 100k with spams, and boom, I can't use it anymore.

KKurzon So hence why I have an API Key so the website can only be authorized/accessed wi...

kian•5/20/24, 10:54 PM

Is the API key static or do you look them up in a database somewhere else?

Kkian Is the API key static or do you look them up in a database somewhere else?

Kurzon•5/20/24, 11:08 PM

API key is static

Kurzon•5/20/24, 11:08 PM

but technically i change them manually

kian•5/20/24, 11:08 PM

Use the WAF to validate it, and blocked requests won’t reach your Worker

Kkian Use the WAF to validate it, and blocked requests won’t reach your Worker

Kurzon•5/20/24, 11:10 PM

Im trying to search up how to enable WAF um

Kurzon•5/20/24, 11:11 PM

not much things are being talked

kian•5/20/24, 11:11 PM

Are you using a custom domain on Cloudflare or the workers.dev URL? If you’re using workers.dev then there isn’t really anything you can do to protect it

Kkian Are you using a custom domain on Cloudflare or the workers.dev URL? If you’re us...

Kurzon•5/20/24, 11:11 PM

Custom domain yes

Kurzon•5/20/24, 11:12 PM

Oh shoot I have to buy it?

Kurzon•5/20/24, 11:13 PM

I mean is there something on the Free plan

Kurzon•5/20/24, 11:13 PM

That at least can protect somewhat

Walshy•5/20/24, 11:13 PM

WAF is free

Kurzon•5/20/24, 11:14 PM

WWalshy WAF is free

Kurzon•5/20/24, 11:15 PM

See here

KKurzon See here

Cyb3r-Jak3•5/20/24, 11:15 PM

That is account level WAF. You can do it per zone for free

Walshy•5/20/24, 11:15 PM

CCyb3r-Jak3 That is account level WAF. You can do it per zone for free

Kurzon•5/20/24, 11:15 PM

How would I do that?

KKurzon How would I do that?

Cyb3r-Jak3•5/20/24, 11:16 PM

Magic Link: https://dash.cloudflare.com/?to=/:account/:zone/security/waf/custom-rules. Make a new rule that checks for the API key in the header and block requests that don't have it

Kurzon•5/20/24, 11:17 PM

oh shoot so my API key has to be static

Kurzon•5/20/24, 11:18 PM

wait but is there a way to do this with only the subdomain....?

Cyb3r-Jak3•5/20/24, 11:19 PM

I mean you can check that the header exists for it like

Authorization

Authorization

but the more specific you can get the more requests you will filter out. For subdomain, you just add an AND condition to the rule to match on the hostname

Kurzon•5/20/24, 11:20 PM

what the heck

Kurzon•5/20/24, 11:20 PM

it said that

Kurzon•5/20/24, 11:20 PM

I Was not allowed to capitalization Authorization

Kurzon•5/20/24, 11:20 PM

so it deleted my rule

Cyb3r-Jak3•5/20/24, 11:22 PM

Here is an expression that I have

not any(lower(http.request.headers.names[*])[*] == "authorization") and http.host eq "example.com"

not any(lower(http.request.headers.names[*])[*] == "authorization") and http.host eq "example.com"

. Which checks that the host is

example.com

example.com

and there a header called

authorization

authorization

CCyb3r-Jak3 Here is an expression that I have `not any(lower(http.request.headers.names[*])[...

Kurzon•5/20/24, 11:23 PM

with the authroization, i want to check if

Bearer [ACCESS_TOKEN]

Bearer [ACCESS_TOKEN]

, is it safe to do that with WAF?

KKurzon with the authroization, i want to check if `Bearer [ACCESS_TOKEN]`, is it safe t...

Cyb3r-Jak3•5/20/24, 11:25 PM

Sure, just make sure the people who have access to your dashboard, you would be okay with sharing the token with

CCyb3r-Jak3 Sure, just make sure the people who have access to your dashboard, you would be ...

Kurzon•5/20/24, 11:25 PM

So, let's say some user got blocked

Kurzon•5/20/24, 11:26 PM

would it count as a "request" of the 100k requests per day

Cyb3r-Jak3•5/20/24, 11:32 PM

No. The request got blocked by Cloudflare before it even reached the worker

CCyb3r-Jak3 No. The request got blocked by Cloudflare before it even reached the worker

Kurzon•5/20/24, 11:32 PM

So I added an API key and subdomain. Do you have any more suggestions for the best protection from any attacks?

Kurzon•5/20/24, 11:33 PM

You're more experienced than me so I would like to know lol

I'm getting a lot of ` Worker exceeded CPU time limit` errors - is it safe to change from `bundled`

Similar Threads

Similar Threads

Similar Threads