I really do not want to cross-post, but I think Cloudflare Tunnels is having problems https://discor

I really do not want to cross-post, but I think Cloudflare Tunnels is having problems https://discord.com/channels/595317990191398933/1276620127676141598/1341745258916216963

Erisa•2/19/25, 12:18 PM

linking to the message is the kindest form of crossposting, i forgive you

SSam I really do not want to cross-post, but I think Cloudflare Tunnels is having pro...

WTDawson9•2/19/25, 1:21 PM

Yeah, I kept on getting notifications a while ago that my tunnels became degraded

JustinNoel•2/19/25, 1:25 PM

I finally got a chance to use the new domain transfer tool to move some domains to a different account. I'm so glad that Cloudflare finally got this done.

Thanks for all the effort

and for putting up for my previous complaining

gpstash•2/19/25, 3:44 PM

Hi!

GuillaumeLakano•2/19/25, 4:48 PM

Hi ! I don't see any report on #status / cloudflarestatus.com about Snippets problems.
We cannot save or deploy our Snippets ( PRO plan )
Even the default snippets proposed
When we arrives on the editor, before doing anything we got this error: API Request Failed: GET /api/v4/zones/xxxxxxxxx/snippets/edge_preview (503)
And on save as draft: API Request Failed: PUT /api/v4/zones/xxxxxxxxxxxxxxx/snippets/basic_auth (503)

WTDawson9•2/19/25, 5:04 PM

https://http.cat/503

WTDawson9•2/19/25, 5:04 PM

Probably temporary

Kimbo•2/19/25, 7:59 PM

Hey guys!
I'm working on an app that uses WebSockets, and it's proxied through Cloudflare. It seems like CF closes WebSocket connections after 90 seconds if the client isn't sending data, even though the server is sending regular pong responses.

Would I be correct in thinking that CF only considers client-to-server traffic when deciding whether to close the connection?

KKimbo Hey guys! I'm working on an app that uses WebSockets, and it's proxied through C...

Laudian•2/19/25, 10:14 PM

I started a websocket ~15 minutes ago and it's still active. Does Chrome have any built-in keepalive for websockets? I don't think it does.

Kimbo•2/19/25, 10:32 PM

I'm logging received pong messages server side, (dev env, local, no proxy), so the client (Chrome) is definitely responding here. I thought pong was a core part of the WebSocket protocol?

KKimbo I'm logging received pong messages server side, (dev env, local, no proxy), so t...

Laudian•2/19/25, 11:03 PM

You're right. My server actually sends a ping every 20 seconds. If I increase that to > 100, the connection is closed.

Isaac McFadyen•2/19/25, 11:27 PM

You likely want to implement application-level pings.

Isaac McFadyen•2/19/25, 11:27 PM

I forgot where but I was recently reading that sometimes the protocol-level pings aren't enough.

Isaac McFadyen•2/19/25, 11:27 PM

A simple pingping text message should do the trick. You'd just need to modify your server code to ignore that message.

Isaac McFadyen•2/19/25, 11:28 PM

Ah, here we go. Python docs but this is applicable in general:

https://websockets.readthedocs.io/en/stable/topics/keepalive.html
Browsers don’t enable a keepalive mechanism like websockets by default. As a consequence, they can fail to notice that a WebSocket connection is broken for an extended period of time, until the TCP connection times out. [...]

Unfortunately, the WebSocket API in browsers doesn’t expose the native Ping and Pong functionality in the WebSocket protocol. You have to roll your own in the application layer.

Original message was deleted

Isaac McFadyen•2/19/25, 11:29 PM

It is but if Chrome doesn't expose it there's not much we can do aside from sending our own :NotLikeThis:

Isaac McFadyen•2/19/25, 11:30 PM

Curious that the user is receiving pongs though, these docs seem to suggest Chrome doesn't send them

Isaac McFadyen•2/19/25, 11:30 PM

Maybe the server is sending pongs but Chrome isn't sending pings?

Kimbo•2/20/25, 12:55 AM

Hmm... this certainly appears to be chrome responding with pong.

Kimbo•2/20/25, 1:55 AM

From what I can tell, CF's proxy does not recognize WebSocket ping/pong frames. It seems to consider a WebSocket connection dead if no application-level messages are sent, even if the server sends pings, the client responds with pongs, and the server successfully receives them. CF ignores these keep-alive signals and still terminates the connection after 90 seconds.

Kimbo•2/20/25, 2:06 AM

I feel this should be more explicitly documented. The 'Best Practices' section suggests implementing keepalive, but it doesn’t state that it’s required to prevent CF from terminating the WebSocket connection after 90 seconds. This could lead to confusion for developers who assume standard WebSocket ping/pong behavior is enough.

Edit: to be more precise

https://developers.cloudflare.com/network/websockets/

Cloudflare Docs

WebSockets · Cloudflare Network settings docs

Cloudflare supports proxied WebSocket connections without additional configuration.

KKimbo From what I can tell, CF's proxy does not recognize WebSocket ping/pong frames. ...

Isaac McFadyen•2/20/25, 2:26 AM

From the screenshot you sent it doesn't look like there are any pings, only pongs

Isaac McFadyen•2/20/25, 2:26 AM

Is your server replying to what Chrome is sending there?

Isaac McFadyen•2/20/25, 2:26 AM

It should reply within 20s or the connection is considered dead per RFC

Kimbo•2/20/25, 2:31 AM

Please do look at the screenshot more closely, it does show the server sending ping, and the client sending back pong. Despite this keep alive most definitely working, CF proxy kills the connection. I am not the only to have hit this, as I have seen other apps having to add an app level keep alive just because of CF.

Isaac McFadyen•2/20/25, 2:57 AM

Ah yeah, apologies I just missed that.

Apoc•2/20/25, 5:59 AM

Does anybody know if it's possible to disable Enterprise Bot Management for a single subdomain? We have requests going cross-zone, and the __cf_bm__cf_bm cookie is causing our Tiered Cache implementation to be skipped because there's a

Set-Cookie

Set-Cookie

header that we have zero control over apparently.

Apoc•2/20/25, 6:16 AM

It doesn't as long as the requests are in the same zone

Apoc•2/20/25, 6:16 AM

And yes, we're on enterprise

Apoc•2/20/25, 6:18 AM

That's my assumption as well, but I also see it the other way around. It's a different zone, so the rules basically act like it's coming from the public internet, so I get it. But it's still incredibly annoying

Apoc•2/20/25, 6:18 AM

Less concerned with the "why" at the moment, more so the "how do I fix this" lol

Apoc•2/20/25, 6:19 AM

You can only add SBFM rules in the dash

Apoc•2/20/25, 6:19 AM

We tried that already, makes no difference

Apoc•2/20/25, 6:20 AM

Event went as far as testing "skip everything", just in case

Apoc•2/20/25, 6:22 AM

Well, we can't do that... Too much traffic (and too many bots)... It's not impacting right this second. We already impacted it when we rolled out the change and found out it broke tiered cache

Apoc•2/20/25, 6:23 AM

Yeah, they're off

Apoc•2/20/25, 6:23 AM

Already put in a ticket, I'll wait on that. It's 1am anyway

enavarrocu•2/20/25, 9:05 AM

Hello everyone, I have a quick question. Is there a way to change the git repository of a cloudflare page?

SShelby•2/20/25, 1:22 PM

hi all

Tekatren (Djkáťo)•2/20/25, 1:26 PM

I can't remember what repo I bound my CF page to, any idea where in the dashboard it tells me which repo it takes from? Can't find it

Yongkie•2/20/25, 2:03 PM

Hi all, I'm trying the possibility to deploy a full stack Astro application with Pages+Functions+Supabase Auth. I created a folder <rootproject>/functions/auth/ containing signin.ts, signup.ts. In the documentation for local development, I can run npx wrangler pages dev <DIRECTORY-OF-ASSETS>npx wrangler pages dev <DIRECTORY-OF-ASSETS>. Can someone explain what is this directory of assets? Is it the distdist folder created after running the command astro buildastro build? I tried npx wrangler pages dev distnpx wrangler pages dev dist. The web app can be opened in the local browser, but trying the signup button returns POST http://localhost:8788/auth/signup 405 (Method Not Allowed)POST http://localhost:8788/auth/signup 405 (Method Not Allowed)

Dubz•2/20/25, 4:36 PM

So what exactly is "CIPA Filter" and when does it apply? Is that for not child safe sites or something? i.e. they may fall for scams, not appropriate/rated for them, etc.?

Erisa•2/20/25, 4:58 PM

the list of things included are here https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cybersafe/#configuration

Erisa•2/20/25, 4:58 PM

its supposed to be any websites you wouldnt want children viewing at school