Cloudflare Developers•2y ago

Use the WAF to validate it, and blocked requests won’t reach your Worker

Kkian Use the WAF to validate it, and blocked requests won’t reach your Worker

Kurzon•5/20/24, 11:10 PM

Im trying to search up how to enable WAF um

Kurzon•5/20/24, 11:11 PM

not much things are being talked

kianOP•5/20/24, 11:11 PM

Are you using a custom domain on Cloudflare or the workers.dev URL? If you’re using workers.dev then there isn’t really anything you can do to protect it

Kkian Are you using a custom domain on Cloudflare or the workers.dev URL? If you’re us...

Kurzon•5/20/24, 11:11 PM

Custom domain yes

Kurzon•5/20/24, 11:12 PM

Oh shoot I have to buy it?

Kurzon•5/20/24, 11:13 PM

I mean is there something on the Free plan

Kurzon•5/20/24, 11:13 PM

That at least can protect somewhat

Walshy•5/20/24, 11:13 PM

WAF is free

Kurzon•5/20/24, 11:14 PM

WWalshy WAF is free

Kurzon•5/20/24, 11:15 PM

See here

KKurzon See here

Cyb3r-Jak3•5/20/24, 11:15 PM

That is account level WAF. You can do it per zone for free

Walshy•5/20/24, 11:15 PM

CCyb3r-Jak3 That is account level WAF. You can do it per zone for free

Kurzon•5/20/24, 11:15 PM

How would I do that?

KKurzon How would I do that?

Cyb3r-Jak3•5/20/24, 11:16 PM

Magic Link: https://dash.cloudflare.com/?to=/:account/:zone/security/waf/custom-rules. Make a new rule that checks for the API key in the header and block requests that don't have it

Kurzon•5/20/24, 11:17 PM

oh shoot so my API key has to be static

Kurzon•5/20/24, 11:18 PM

wait but is there a way to do this with only the subdomain....?

Cyb3r-Jak3•5/20/24, 11:19 PM

I mean you can check that the header exists for it like

Authorization

Authorization

but the more specific you can get the more requests you will filter out. For subdomain, you just add an AND condition to the rule to match on the hostname

Kurzon•5/20/24, 11:20 PM

what the heck

Kurzon•5/20/24, 11:20 PM

it said that

Kurzon•5/20/24, 11:20 PM

I Was not allowed to capitalization Authorization

Kurzon•5/20/24, 11:20 PM

so it deleted my rule

Cyb3r-Jak3•5/20/24, 11:22 PM

Here is an expression that I have

not any(lower(http.request.headers.names[*])[*] == "authorization") and http.host eq "example.com"

not any(lower(http.request.headers.names[*])[*] == "authorization") and http.host eq "example.com"

. Which checks that the host is

example.com

example.com

and there a header called

authorization

authorization

CCyb3r-Jak3 Here is an expression that I have `not any(lower(http.request.headers.names[*])[...

Kurzon•5/20/24, 11:23 PM

with the authroization, i want to check if

Bearer [ACCESS_TOKEN]

Bearer [ACCESS_TOKEN]

, is it safe to do that with WAF?

KKurzon with the authroization, i want to check if `Bearer [ACCESS_TOKEN]`, is it safe t...

Cyb3r-Jak3•5/20/24, 11:25 PM

Sure, just make sure the people who have access to your dashboard, you would be okay with sharing the token with

CCyb3r-Jak3 Sure, just make sure the people who have access to your dashboard, you would be ...

Kurzon•5/20/24, 11:25 PM

So, let's say some user got blocked

Kurzon•5/20/24, 11:26 PM

would it count as a "request" of the 100k requests per day

Cyb3r-Jak3•5/20/24, 11:32 PM

No. The request got blocked by Cloudflare before it even reached the worker

CCyb3r-Jak3 No. The request got blocked by Cloudflare before it even reached the worker

Kurzon•5/20/24, 11:32 PM

So I added an API key and subdomain. Do you have any more suggestions for the best protection from any attacks?

Kurzon•5/20/24, 11:33 PM

You're more experienced than me so I would like to know lol

KKurzon So I added an API key and subdomain. Do you have any more suggestions for the be...

Cyb3r-Jak3•5/20/24, 11:49 PM

API Key is the best way. Means all requests need to have it so you can easily filter requests

jdaccount•5/21/24, 5:30 AM

Hey guys, I facing the issues all my pages and workers throwing Error 1101 Worker threw exception all of a sudden, anyone facing this or know why this happen?

Advany•5/21/24, 5:56 AM

Is ghet

berkinovish•5/21/24, 12:43 PM

Hi guys,

We are using Workers and Queues to upload large files (500+ MB) to R2. We stream files from the source, via the Queue consumer, to R2. According to the docs on Worker limits, Queue consumers should have 15 minutes of CPU time. However, we consistently get an

exceededCpu

exceededCpu

error after just 30 seconds of CPU time. Are the docs incorrect, or are we doing something wrong?

I created a small reproducible demo here: https://github.com/dealside/r2-upload-queue

Sandeep•5/21/24, 3:23 PM

Hello everyone!
Is there any way possible in the worker script where I can generate thumbnail of a video which is uploaded to the R2 bucket?

Isak•5/21/24, 3:47 PM

When will pages support rate limit bindings?

Rabid•5/21/24, 3:47 PM

Anyone have an example of a self binding worker?

Rabid•5/21/24, 3:47 PM

I have my cron handler here:

export default {
  async scheduled(controller, env, ctx) {

    console.log(await env.LEADERBOARD_FETCHER.fetchRegionLeaderboardData('us', '2v2'))
  }
}

export default {
  async scheduled(controller, env, ctx) {

    console.log(await env.LEADERBOARD_FETCHER.fetchRegionLeaderboardData('us', '2v2'))
  }
}

Rabid•5/21/24, 3:48 PM

And in the same file/worker I have my function:

export class LeaderboardFetcher extends WorkerEntrypoint {
  async fetchRegionLeaderboardData(region, type) {

export class LeaderboardFetcher extends WorkerEntrypoint {
  async fetchRegionLeaderboardData(region, type) {

Rabid•5/21/24, 3:48 PM

I get "The RPC receiver does not implement the mthod "fetchRegionLeaderboardData"

Rabid•5/21/24, 4:19 PM

And how to access env (for D1 bindings) in the called RPC function.

johtso•5/21/24, 6:43 PM

what's the default fetch timeout in workers?

Chaika•5/21/24, 6:56 PM

there's a nice doc going over all the network limits now: https://developers.cloudflare.com/fundamentals/reference/connection-limits/

Cloudflare Docs

Connection limits · Cloudflare Fundamentals docs

When HTTP/HTTPS traffic is proxied through Cloudflare, there are often two established TCP connections: the first is between the requesting client to …