how private are pages projects...i just got a request for /js/twint_ch.js on my page.dev domain on m

how private are pages projects...i just got a request for /js/twint_ch.js on my page.dev domain on my console logs....but that file doesn't exist and nobody should have access to anything i am doing that would request that...idea?

Ccaptain how private are pages projects...i just got a request for /js/twint_ch.js on my ...

Ashley•3/4/25, 5:41 PM

The internet is littered with bots and your pages.dev domain is public, and things like DNS are too, so bots end up finding it

AAshley The internet is littered with bots and your pages.dev domain is public, and thin...

captainOP•3/4/25, 5:41 PM

that's scary..how do they find it, is cloudflare publicizing it?

captainOP•3/4/25, 5:42 PM

or is there a mouse in the house and cloudflare dev ops need to wake up

Silvan•3/4/25, 5:44 PM

welcome to the internet.. its normal

Ccaptain that's scary..how do they find it, is cloudflare publicizing it?

Ashley•3/4/25, 5:46 PM

This is just how the internet works, anything public can be found and bots are everywhere - it’s nothing to worry about though, assuming what you have there isn’t private data or anything

Silvan•3/4/25, 5:49 PM

What im more confused about now is how i pass the ctx.waitUntil to a function

i ran into the classic TypeError: Illegal invocation: function called with incorrect this referenceTypeError: Illegal invocation: function called with incorrect this reference first. now when i pass down the entire platform into the function waitUntil ends up undefined (its available where im trying to pass it to the function)

do i really need apply/call in that situtation?

Ccaptain that's scary..how do they find it, is cloudflare publicizing it?

Chaika•3/4/25, 6:10 PM

Every pages.dev gets a certificate, certificates are all logged as part of Certificate Transparency (CT) Logs the second they are issued, bots listen to CT Logs

CChaika Every pages.dev gets a certificate, certificates are all logged as part of Certi...

captainOP•3/4/25, 7:01 PM

that seems to be a security risk the platform in users...why is that public?

Ccaptain that seems to be a security risk the platform in users...why is that public?

Isaac McFadyen•3/4/25, 7:01 PM

It's just how the internet works. It's not specific to Cloudflare, every platform works this way.

Isaac McFadyen•3/4/25, 7:01 PM

Any time a certificate is issued, anywhere (that is trusted by browsers), it's logged publicly.

Ccaptain that seems to be a security risk the platform in users...why is that public?

Chaika•3/4/25, 7:01 PM

opposite, Certificates Issuance are public to increase security. So no Certificate Authority can issue Certificates without it being known

Isaac McFadyen•3/4/25, 7:01 PM

https://letsencrypt.org/docs/ct-logs/

IIsaac McFadyen It's just how the internet works. It's not specific to Cloudflare, *every* platf...

captainOP•3/4/25, 7:02 PM

okay so...would it not be smarter to set these tempory pages.dev things via: page.dev/subfolder instead a a subdomain?

Ccaptain okay so...would it not be smarter to set these tempory pages.dev things via: pag...

Hard@Work•3/4/25, 7:02 PM

Some projects deployed to Pages may expect a (sub)domain to themselves

Ccaptain okay so...would it not be smarter to set these tempory pages.dev things via: pag...

Isaac McFadyen•3/4/25, 7:03 PM

The issue with this is that they have no way to know what you have on the production domain.

Isaac McFadyen•3/4/25, 7:03 PM

If you put it at /foo/foo then what if I have a file/folder in prod that's called /foo/foo?

Isaac McFadyen•3/4/25, 7:03 PM

It would overwrite it.

Ccaptain okay so...would it not be smarter to set these tempory pages.dev things via: pag...

Chaika•3/4/25, 7:03 PM

No, for security again, as pages.dev uses subdomains and is part of the public suffix list, browsers treat each subdomain as its own website, separated in terms of cookies, cors, etc

Chaika•3/4/25, 7:04 PM

If you were using subpaths, browsers would assume each pages website are part of the same security context/get around some limits of CORS, allow access to cookies, etc

Chaika•3/4/25, 7:05 PM

oh, even if you mean just for preview URLs it'd still be more way messy for the reasons Isaac said

CChaika If you were using subpaths, browsers would assume each pages website are part of...

captainOP•3/4/25, 7:06 PM

this is all true, but also true is that these bots are a problem. perhaps on this domain cloudflare could think of a way to be more pro-active against the bots and honey pot them to immediately get them on a block list. Or maybe they are and this is just one that got through

CChaika If you were using subpaths, browsers would assume each pages website are part of...

Isaac McFadyen•3/4/25, 7:06 PM

Even for preview URLs this would apply ^

Isaac McFadyen•3/4/25, 7:06 PM

Imagine if you set a cookie on the preview path to log a user in, and then it applies on the prod path too

Ccaptain this is all true, but also true is that these bots are a problem. perhaps on thi...

Chaika•3/4/25, 7:06 PM

Bots just aren't really an issue, and it's very difficult to block only the bad ones without blocking intentional ones

Isaac McFadyen•3/4/25, 7:06 PM

You can always put Access in front if you're worried about security.

CChaika Bots just aren't really an issue, and it's very difficult to block only the bad ...

captainOP•3/4/25, 7:08 PM

if some ip keeps making requests for non existant files accross multiple sub domains...say 20 times..or some threshold...thats not a signal that could be automated to trigger it as a bad actor?

Ccaptain if some ip keeps making requests for non existant files accross multiple sub dom...

Chaika•3/4/25, 7:08 PM

or it could just be a crawler following bad links?

CChaika or it could just be a crawler following bad links?

captainOP•3/4/25, 7:09 PM

this would be specific to pages.dev

Chaika•3/4/25, 7:09 PM

doesn't change that

captainOP•3/4/25, 7:09 PM

page.dev isn't meant for seo crawling scenarios

captainOP•3/4/25, 7:09 PM

or to be indexed

Chaika•3/4/25, 7:10 PM

Static Requests are super cheap to Cloudflare and get even cheaper the more cache gets hit

Ccaptain if some ip keeps making requests for non existant files accross multiple sub dom...

Isaac McFadyen•3/4/25, 7:10 PM

How do you propose tracking that, though? Imagine if 32 users (Starlink) share an IP, and they hit 404s. If you block that IP you might be blocking 1 bad user but 31 good users who hit a 404.

Chaika•3/4/25, 7:10 PM

It'd most likely be more compute intensive to try to store/do all that, then just serve the static requests

IIsaac McFadyen How do you propose tracking that, though? Imagine if 32 users (Starlink) share a...

captainOP•3/4/25, 7:10 PM

cool down period?

Chaika•3/4/25, 7:10 PM

Doing all that across tons of machines is a ton of cost of sync, and a ton of code to go wrong, etc

Chaika•3/4/25, 7:11 PM

at some point workers-and-pages-discussions

Chaika•3/4/25, 7:11 PM

Any anti abuse stuff like that can go wrong too and block legit use cases, just not worth it

captainOP•3/4/25, 7:11 PM

because cloudflare has so much traffic going through it..at some point its the only answer to crush the bot delema that soaks up so much computer and bandwith on the internet

captainOP•3/4/25, 7:12 PM

Denial of service attacks only exists because there is no communication or effort amongst hosts to do anything

captainOP•3/4/25, 7:13 PM

only cloudlfare has the ability to centralize an effort

Chaika•3/4/25, 7:13 PM

Bandwidth is pretty cheap to CF in most cases with their vast network, and compute is more expensive to do anti-bot stuff across thousands of machines then to just serve static assets which can be cached everywhere

captainOP•3/4/25, 7:13 PM

of my VPS servers that run behind cloudflare, 80% of the cpu is just bots going for non existant files

captainOP•3/4/25, 7:14 PM

and occassionally i'll drop in, block an ASN and then it will be another ASN 1 month later

Ccaptain of my VPS servers that run behind cloudflare, 80% of the cpu is just bots going ...

Isaac McFadyen•3/4/25, 7:14 PM

Sure but at that point it's very user-specific and Cloudflare wouldn't take action to block things on your own domain when it might be blocking things for legitimate users.

captainOP•3/4/25, 7:14 PM

sending any abuse type email is generally never read

Isaac McFadyen•3/4/25, 7:14 PM

If you want to reduce that kind of thing you can deploy your own rules that are tailored to your specific domain

Isaac McFadyen•3/4/25, 7:15 PM

I.e rate limiting rules.

captainOP•3/4/25, 7:16 PM

i mean i do it for my domains already, i'm suggesting something just for pages.dev, but also my 2ndary conversation is the concept of cloudflare being the hub to lower bot traffic in the world in some way. It would be a form of community service in line with how it pushed back against patent trolls.

captainOP•3/4/25, 7:16 PM

just an idea

how private are pages projects...i just got a request for /js/twint_ch.js on my page.dev domain on m

Similar Threads

Similar Threads

Similar Threads