Hey guys! I'm working on an app that uses WebSockets, and it's proxied through Cloudflare. It seems

Hey guys!
I'm working on an app that uses WebSockets, and it's proxied through Cloudflare. It seems like CF closes WebSocket connections after 90 seconds if the client isn't sending data, even though the server is sending regular pong responses.

Would I be correct in thinking that CF only considers client-to-server traffic when deciding whether to close the connection?

KKimbo Hey guys! I'm working on an app that uses WebSockets, and it's proxied through C...

Laudian•2/19/25, 10:14 PM

I started a websocket ~15 minutes ago and it's still active. Does Chrome have any built-in keepalive for websockets? I don't think it does.

KimboOP•2/19/25, 10:32 PM

I'm logging received pong messages server side, (dev env, local, no proxy), so the client (Chrome) is definitely responding here. I thought pong was a core part of the WebSocket protocol?

KKimbo I'm logging received pong messages server side, (dev env, local, no proxy), so t...

Laudian•2/19/25, 11:03 PM

You're right. My server actually sends a ping every 20 seconds. If I increase that to > 100, the connection is closed.

Isaac McFadyen•2/19/25, 11:27 PM

You likely want to implement application-level pings.

Isaac McFadyen•2/19/25, 11:27 PM

I forgot where but I was recently reading that sometimes the protocol-level pings aren't enough.

Isaac McFadyen•2/19/25, 11:27 PM

A simple pingping text message should do the trick. You'd just need to modify your server code to ignore that message.

Isaac McFadyen•2/19/25, 11:28 PM

Ah, here we go. Python docs but this is applicable in general:

https://websockets.readthedocs.io/en/stable/topics/keepalive.html
Browsers don’t enable a keepalive mechanism like websockets by default. As a consequence, they can fail to notice that a WebSocket connection is broken for an extended period of time, until the TCP connection times out. [...]

Unfortunately, the WebSocket API in browsers doesn’t expose the native Ping and Pong functionality in the WebSocket protocol. You have to roll your own in the application layer.

Original message was deleted

Isaac McFadyen•2/19/25, 11:29 PM

It is but if Chrome doesn't expose it there's not much we can do aside from sending our own :NotLikeThis:

Isaac McFadyen•2/19/25, 11:30 PM

Curious that the user is receiving pongs though, these docs seem to suggest Chrome doesn't send them

Isaac McFadyen•2/19/25, 11:30 PM

Maybe the server is sending pongs but Chrome isn't sending pings?

KimboOP•2/20/25, 12:55 AM

Hmm... this certainly appears to be chrome responding with pong.

KimboOP•2/20/25, 1:55 AM

From what I can tell, CF's proxy does not recognize WebSocket ping/pong frames. It seems to consider a WebSocket connection dead if no application-level messages are sent, even if the server sends pings, the client responds with pongs, and the server successfully receives them. CF ignores these keep-alive signals and still terminates the connection after 90 seconds.

KimboOP•2/20/25, 2:06 AM

I feel this should be more explicitly documented. The 'Best Practices' section suggests implementing keepalive, but it doesn’t state that it’s required to prevent CF from terminating the WebSocket connection after 90 seconds. This could lead to confusion for developers who assume standard WebSocket ping/pong behavior is enough.

Edit: to be more precise

https://developers.cloudflare.com/network/websockets/

Cloudflare Docs

WebSockets · Cloudflare Network settings docs

Cloudflare supports proxied WebSocket connections without additional configuration.

KKimbo From what I can tell, CF's proxy does not recognize WebSocket ping/pong frames. ...

Isaac McFadyen•2/20/25, 2:26 AM

From the screenshot you sent it doesn't look like there are any pings, only pongs

Isaac McFadyen•2/20/25, 2:26 AM

Is your server replying to what Chrome is sending there?

Isaac McFadyen•2/20/25, 2:26 AM

It should reply within 20s or the connection is considered dead per RFC

KimboOP•2/20/25, 2:31 AM

Please do look at the screenshot more closely, it does show the server sending ping, and the client sending back pong. Despite this keep alive most definitely working, CF proxy kills the connection. I am not the only to have hit this, as I have seen other apps having to add an app level keep alive just because of CF.

Isaac McFadyen•2/20/25, 2:57 AM

Ah yeah, apologies I just missed that.

Apoc•2/20/25, 5:59 AM

Does anybody know if it's possible to disable Enterprise Bot Management for a single subdomain? We have requests going cross-zone, and the __cf_bm__cf_bm cookie is causing our Tiered Cache implementation to be skipped because there's a Set-CookieSet-Cookie header that we have zero control over apparently.

Apoc•2/20/25, 6:16 AM

It doesn't as long as the requests are in the same zone

Apoc•2/20/25, 6:16 AM

And yes, we're on enterprise

Apoc•2/20/25, 6:18 AM

That's my assumption as well, but I also see it the other way around. It's a different zone, so the rules basically act like it's coming from the public internet, so I get it. But it's still incredibly annoying

Apoc•2/20/25, 6:18 AM

Less concerned with the "why" at the moment, more so the "how do I fix this" lol

Apoc•2/20/25, 6:19 AM

You can only add SBFM rules in the dash

Apoc•2/20/25, 6:19 AM

We tried that already, makes no difference

Apoc•2/20/25, 6:20 AM

Event went as far as testing "skip everything", just in case

Apoc•2/20/25, 6:22 AM

Well, we can't do that... Too much traffic (and too many bots)... It's not impacting right this second. We already impacted it when we rolled out the change and found out it broke tiered cache

Apoc•2/20/25, 6:23 AM

Yeah, they're off

Apoc•2/20/25, 6:23 AM

Already put in a ticket, I'll wait on that. It's 1am anyway

enavarrocu•2/20/25, 9:05 AM

Hello everyone, I have a quick question. Is there a way to change the git repository of a cloudflare page?

SShelby•2/20/25, 1:22 PM

hi all

Tekatren (Djkáťo)•2/20/25, 1:26 PM

I can't remember what repo I bound my CF page to, any idea where in the dashboard it tells me which repo it takes from? Can't find it

Yongkie•2/20/25, 2:03 PM

Hi all, I'm trying the possibility to deploy a full stack Astro application with Pages+Functions+Supabase Auth. I created a folder <rootproject>/functions/auth/ containing signin.ts, signup.ts. In the documentation for local development, I can run npx wrangler pages dev <DIRECTORY-OF-ASSETS>npx wrangler pages dev <DIRECTORY-OF-ASSETS>. Can someone explain what is this directory of assets? Is it the distdist folder created after running the command astro buildastro build? I tried npx wrangler pages dev distnpx wrangler pages dev dist. The web app can be opened in the local browser, but trying the signup button returns POST http://localhost:8788/auth/signup 405 (Method Not Allowed)POST http://localhost:8788/auth/signup 405 (Method Not Allowed)

Dubz•2/20/25, 4:36 PM

So what exactly is "CIPA Filter" and when does it apply? Is that for not child safe sites or something? i.e. they may fall for scams, not appropriate/rated for them, etc.?

Erisa•2/20/25, 4:58 PM

the list of things included are here https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cybersafe/#configuration

Erisa•2/20/25, 4:58 PM

its supposed to be any websites you wouldnt want children viewing at school

EErisa its supposed to be any websites you wouldnt want children viewing at school

Dubz•2/20/25, 5:12 PM

Just school specifically or in general?

Dubz•2/20/25, 5:13 PM

I guess that makes it something a school district would use then?

DDubz Just school specifically or in general?

Erisa•2/20/25, 5:13 PM

CIPA is only mandated to be enforced within schools

DDubz I guess that makes it something a school district would use then?

Erisa•2/20/25, 5:13 PM

yes, thats exactly what its for

Dubz•2/20/25, 5:23 PM

ahhhh that makes sense

Dubz•2/20/25, 5:50 PM

someone really got that user and joined the server lmao

YYongkie Hi all, I'm trying the possibility to deploy a full stack Astro application with...

gruntlord6•2/20/25, 7:34 PM

I'd recommend using the astro starter for cf to get a feel for it, initially we just uploaded it as a static site with workers managing anything that needed interaction but we recently started deploying more advanced astro projects through ci/cid and that's been a lot smoother

gruntlord6•2/20/25, 7:35 PM

If someone more experienced has more to add then feel free, just figured I'd offer some base level advice

Zakko•2/20/25, 10:08 PM

Does anyone happen to know how long logs are stored when using a free plan of Pages? This is just information for the privacy policy, as right now it is just something akin to "log files are periodically wiped" which I think technically is enough, but GDPR to my knowledge recommends saying how long such stuff is stored. Although if stating it's periodically wiped is good enough then that's also fine

Walshy•2/20/25, 10:38 PM

I don't know if we have a number anywhere, if we do it'll be somewhere in here: https://www.cloudflare.com/en-gb/privacypolicy/

Brabmore•2/21/25, 1:54 AM

Hello I have been having issues with the captcha all day haven’t been able to to get it to work none of the day I’m useing the polgonscan on coin base please help

Brabmore•2/21/25, 1:54 AM

Please help

o7•2/21/25, 5:20 AM

Is smart placement not recommended for applications with globally spread databases?

e.g. traffic in Chicago convinces smart placement that ORD is the optimal colo to complete requests in, as there is a DB in Chicago awaiting writes...

Will traffic from California, be routed through the ORD worker?... considering there will also be a closer DB within California they will (by design) have to hit anyway

Or will smart placement eventually learn that California and Chicago traffic has to be specifically ran in different colos

jordan•2/21/25, 10:35 AM

is this (recreating my favorite parts of Firestore in DO) super dumb or potentially something worth exploring? i can't tell.. https://github.com/acoyfellow/blaze

if we think of a DO like a single "document"... is that crazy to think it's like a document with superpowers? what if a firestore document itself was a little server?

Hey guys! I'm working on an app that uses WebSockets, and it's proxied through Cloudflare. It seems

Similar Threads

Similar Threads

Similar Threads