Is it possible for anyone - either a user or cloudflare employees - to download built/deployed worke

Is it possible for anyone - either a user or cloudflare employees - to download built/deployed worker code? It seems there is not - and I'm hoping there is not. I'm trying to understand security implications of any sensitive secrets being in that code.

theoOP•12/17/24, 5:51 AM

(and I do know about the Workers Secrets functionality)

Ttheo Is it possible for anyone - either a user or cloudflare employees - to download ...

Hello, I’m Allie!•12/17/24, 5:53 AM

Users with access to your account are able to download your scripts, they are not end-to-end encrypted in that sense

HHello, I’m Allie!Users with access to your account are able to download your scripts, they are no...

theoOP•12/17/24, 5:55 AM

how? where? I don't see anywhere in the UI to download the built code of a specific version of a deployment

theoOP•12/17/24, 5:57 AM

Oh I just found the "edit code" button in the top right. Had not seen that before.

theoOP•12/17/24, 6:02 AM

I assume there's no way to disable that? Considering the code visible there (in most cases) is the esbuild-bundled code, and editing it would circumvent CI and other tooling and workflows, it's kind of useless anyway. Removing the ability to access it would be helpful to me from a security standpoint. (added a note in #workers-feature-suggestions)

Ttheo I assume there's no way to disable that? Considering the code visible there (in ...

Hello, I’m Allie!•12/17/24, 6:34 AM

Even if you were able to prevent downloads, that wouldn’t stop someone from account access from disabling your Worker, or replacing it with a script of their own

theoOP•12/17/24, 6:36 AM

that's ok - my main concern is accessing the code. But discouraging/stopping someone from using that edit interface to change and redeploy the worker is also a nice bonus

Ttheo that's ok - my main concern is accessing the code. But discouraging/stopping som...

Hello, I’m Allie!•12/17/24, 6:39 AM

Also, iirc there was a point where Workers deployed via Wrangler weren’t editable in the dash, but iirc they rolled that back because people wanted to be able to use it anyway

Hello, I’m Allie!•12/17/24, 6:40 AM

I know I’ve sometimes used QuickEdit to make some fast changes on the go

theoOP•12/17/24, 6:40 AM

I could imagine a simple setting to just disable it

theoOP•12/17/24, 6:41 AM

whether in wrangler.toml, or a flag during deploy or both

Wwaterbottle Hi all! I’m new to workers, so this may be a noob question. How do you configure...

Ashley•12/17/24, 8:46 AM

Fundamentally, you would point your domain to Cloudflare usung DNS or Nameservers, after adding the domain to your Cloudflare account and then configure your Worker to handle traffic for that domain using Worker Routes. Keep in mind once you change the DNS, if you only want Cloudflare to handle redirects, and still serve content that currently exists, you’ll need to set that up to.

Sloy•12/17/24, 8:49 AM

does cloudlfare worker request to http2 ? like APNs

haile•12/17/24, 8:49 AM

haile•12/17/24, 8:51 AM

i am very confused about preview captcha not showing :blob_sweat: at worker proxy

Burrito•12/17/24, 11:10 AM

For ESBuild bundling, is there a way to turn on --minify-syntax--minify-syntax? It seems that dead code like if (false) { ... }if (false) { ... } do not get eliminated.

Burrito•12/17/24, 11:17 AM

Ah, seems like

wrangler deploy

wrangler deploy

's --minify--minify turns on all minify features of ESBuild (so whitespace + identifiers + syntax), and it's off by default. Is this safe?

haile•12/17/24, 11:42 AM

thank ill try it

BBurrito For ESBuild bundling, is there a way to turn on `--minify-syntax`? It seems that...

haile•12/17/24, 4:04 PM

do you have example

Burrito•12/17/24, 4:06 PM

My question wasn't related to yours, in case that's why you are asking.

Burrito•12/17/24, 4:06 PM

But for minifying, you can set minify = trueminify = true in

wrangler.toml

wrangler.toml

or pass directly to CLI via --minify--minify.

dave•12/17/24, 8:09 PM

Is there a simple way to only allow my Cron job to have 1 instance running at a time?

Original message was deleted

dave•12/17/24, 8:11 PM

that seems kinda heavy handed to add a DO just for a lock, no?

dave•12/17/24, 8:12 PM

I'm using Hyperdrive, I guess I could do a lock somehow with the database?

Ccomagoosie Hmm my Cloudflare workers was sporadically throwing 500's "Script not found" err...

Chaika•12/17/24, 8:27 PM

I saw that too, hopefully we get a retroactive status page if nothing else. Was it a worker using static assets?

Chaika•12/17/24, 8:28 PM

Same for me. I bet the static asset handling part is a worker on its own which had an issue for a bit, or at least it's def related to that in some way. All my other workers were fine

Ccomagoosie Hmm my Cloudflare workers was sporadically throwing 500's "Script not found" err...

Chaika•12/17/24, 8:47 PM

retroactive status page https://www.cloudflarestatus.com/incidents/bsff6fmj9w3z

Issue with Workers Assets

Constantin•12/17/24, 9:53 PM

hey there, i'm facing this weird behaviour when using lower case, for navigation word the pipeline fails finding the module, still both versions works on local.

import Navigation from "~/components/Navigation"; OK
import Navigation from "~/components/navigation"; FAIL
import Footer from "~/components/footer"; OK

Constantin•12/17/24, 9:54 PM

is navigationnavigation a reserved word or has a distinct treatment in the workers builing pipeline context?

CConstantin hey there, i'm facing this weird behaviour when using lower case, for navigatio...

Chaika•12/17/24, 10:02 PM

If you're devving on Windows, it's going to be case insensitive until it hits the linux-based very much case sensitive build ci/cd env

Constantin•12/17/24, 10:02 PM

nah, it mac .. weird things

Chaika•12/17/24, 10:03 PM

I think mac is case insensitive too by default? I mean, what's the actual file name you're trying to import?

Constantin•12/17/24, 10:07 PM

so i'm having /landing/navigation/index.tsx/landing/navigation/index.tsx exporting export default ...

then using
import Navigation from "~/components/landing/navigation";

all good on local, fails on CF side.

Why i'm saying is very weird, is because if i rename the directory from navigationnavigation to navnav and update the inport too. CF works also

Constantin•12/17/24, 10:32 PM

huh, so very weird .. navigationnavigation, headerheader directory names not working, but navnav does

Constantin•12/17/24, 10:47 PM

well, i think i was messing with the tsconfig. looking to another cf worker example and this seems to work now. ty @Chaika

theoOP•12/17/24, 10:53 PM

there are weird case issues with git and mac vs linux. On many projects I've tried to name everything in kebab-casekebab-case to avoid it, but it is a bit of a pain when dealing with frontend PascalCasePascalCase components.
As you have just discovered, it will bite you when you try to change the case only on something.

jsk•12/17/24, 11:21 PM

Any recommended way to cache Google API Oauth Tokens on a free workers plan without using a db or cloud storage solution?

Found this when searching but not sure if its recommended in 2024

Isaac McFadyen•12/17/24, 11:26 PM

without using a db or cloud storage solution

The answer in the screenshot is really the only way to do so. Keep in mind that it's only going to be cached in the colo the Worker is running in, so if another Worker in another colo is triggered then it won't see the cached value.

Walshy•12/17/24, 11:27 PM

Any reason to not use a db like d1?

Isaac McFadyen•12/17/24, 11:27 PM

^ or KV

jsk•12/17/24, 11:32 PM

Ah given my Google oauth token has a TTL of approx 3600s, i would attach something like this to my fetch request and it should ~roughly reduce some request load given a worker in the same data center is executed?

cf: {
// Always cache this fetch regardless of content type
// for a max of 5 seconds before revalidating the resource
cacheTtl: 3400,
},

This is for a project operating at very small scale, think a request load of ~ <= 125/month on average hitting this api endpoint and thats an estimate on the high side -- i don't want to inject the complexity of a full blown db in this case

I would probably be fine with just refreshing the google oauth tokens as well on every request but don't mind understanding if there are some optimizations Cloudflare provides for cases like this

Jjsk Ah given my Google oauth token has a TTL of approx 3600s, i would attach somethi...

Isaac McFadyen•12/17/24, 11:50 PM

So two main points based on your requirements:

This is an OK solution if you don't want to involve a DB.
At that low load then it probably won't do anything anyway, though, because 3400 is "3400 seconds" which is around an hour. If you have less than 125 req/month, then unless more than 1 per hour comes in (1 per hour and in the same colo, and Cloudflare has more than 350 so that's quite unlikely) then it won't be cached.
At that low load then you really don't need to worry about Google OAuth's servers, they can easily handle that load and I expect they're fairly quick (unsure?) so the actual OAuth refresh is likely less than the thing you're using the token for anyway.

Leo_C•12/18/24, 2:42 AM

I want to ask if there was any issue with the assets binded worker around 20:00 UTC on December 17th. There was a moment when my website was inaccessible, but there were no actual losses. I am aware that we are still in the testing phase, but curiosity makes me wonder what happened behind the scenes.:MeowHeartCloudflare:

LLeo_C I want to ask if there was any issue with the assets binded worker around 20:00 ...

Chaika•12/18/24, 2:53 AM

yes https://www.cloudflarestatus.com/incidents/bsff6fmj9w3z

Issue with Workers Assets

Starry Miracle•12/18/24, 3:48 AM

Hi! I am new to workers. Currently I build a worker to fetch an API and compare with the result fetched 5 minutes ago (with cron).

I am using KV to store that API result so that I can use it for comparison for the next call. Is there better way to store the result for use a? Is using KV/D1 a must?

One of the concern is KV write/day will be 24*60/5=28824*60/5=288, and this is not really scaleable if the free quota only has 1000 write/day. getting 4 API will exceed the free quota... and I probably need more only in testing stage.

Starry Miracle•12/18/24, 3:50 AM

Another question: may I know the reason why even when I am using dashboard to create a new worker (from Hello World template), the logging will automatically turn off when I publish a new version, even if I am not using wrangler in the whole project? Am I doing anything wrong?

Trojan•12/18/24, 12:54 PM

i know this is a reach but does cloudflare workers have any plans to support docker containers like google cloud run?

Trojan•12/18/24, 12:55 PM

i would love to take advantage of a serverless http3 solution

Is it possible for anyone - either a user or cloudflare employees - to download built/deployed worke

Similar Threads

Similar Threads

Similar Threads