Cloudflare Developers•9mo ago

Will this enforce Google Workspace as the login method, or will it only enforce the email address?

daveOP•4/3/25, 7:19 PM

I can't create a policy without at least one include rule.

daveOP•4/3/25, 7:19 PM

(I wanted to do two require rules, but that's not allowed.)

Ddave Will this enforce Google Workspace as the login method, or will it only enforce ...

Erisa•4/3/25, 7:27 PM

yes, it will allow example@example.com to connect, and only using Google Workspace
thats exactly the kind of use-case that the include/require distinction exists for

daveOP•4/3/25, 7:34 PM

Can I do double subdomain wildcards in Access?

I want to protect everything like 12345a6c.demo.pages.dev12345a6c.demo.pages.dev, 12345a6c.demo2.pages.dev12345a6c.demo2.pages.dev, demo.pages.devdemo.pages.dev , 12345a6c.demo2.pages.dev12345a6c.demo2.pages.dev , demo2.pages.devdemo2.pages.dev, etc.

Erisa•4/3/25, 7:38 PM

.pages.dev are special-cased as being treated as a single "domain" so you can just enter * as the subdomain and demo.pages.dev as the domain

Erisa•4/3/25, 7:39 PM

this is not technically wrong since pages.dev is on the public suffix list

EErisa .pages.dev are special-cased as being treated as a single "domain" so you can ju...

daveOP•4/3/25, 7:39 PM

So this will match 12345a6c.demo.pages.dev12345a6c.demo.pages.dev?

Erisa•4/3/25, 7:40 PM

youd do *.demo.pages.dev and *.demo2.pages.dev separately i'd think, but also hmm i've not seen that specific ui before i wonder if its new

EErisa youd do \*.demo.pages.dev and *.demo2.pages.dev separately i'd think, but also h...

daveOP•4/3/25, 7:41 PM

ouuuf, so for all new pages.dev projects, I would need to manually add a new subdomain?

Erisa•4/3/25, 7:41 PM

well that used to be the case but im not so sure with this new interface if thats still a restriction

Erisa•4/3/25, 7:42 PM

I would say try it and see!

EErisa youd do \*.demo.pages.dev and *.demo2.pages.dev separately i'd think, but also h...

Isaac McFadyen•4/3/25, 7:42 PM

It's new, the customcustom dropdown just lets you choose between free-text and the domain picker from before

Erisa•4/3/25, 7:42 PM

cool

Isaac McFadyen•4/3/25, 7:42 PM

It replaced the old method of only being able to pick from the dropdown

daveOP•4/3/25, 7:44 PM

kk trying this first, then pages

daveOP•4/3/25, 7:49 PM

*.workers.dev*.workers.dev is a no-no

Original message was deleted

daveOP•4/3/25, 7:53 PM

thanks! I figured out that this is the correct way to protect all workers.dev stuff.

Ddave thanks! I figured out that this is the correct way to protect all workers.dev st...

daveOP•4/3/25, 7:56 PM

@FloppyDisk This won't impact Cron Workers or any service bindings, right?

daveOP•4/3/25, 7:59 PM

seems to be working

daveOP•4/3/25, 8:00 PM

ya no impact

EErisa .pages.dev are special-cased as being treated as a single "domain" so you can ju...

daveOP•4/3/25, 8:03 PM

Can't use *.pages.dev*.pages.dev.

Erisa•4/3/25, 8:04 PM

mmmm that makes sense but also sucks

EErisa .pages.dev are special-cased as being treated as a single "domain" so you can ju...

daveOP•4/3/25, 8:10 PM

It looks like I need two hostnames for each project. One for *.demo.pages.dev*.demo.pages.dev and one for demo.pages.devdemo.pages.dev.

daveOP•4/3/25, 8:10 PM

Just doing *.demo.pages.dev*.demo.pages.dev doesn't match demo.pages.devdemo.pages.dev.

Erisa•4/3/25, 8:13 PM

hmmm yes, youre right

daveOP•4/3/25, 8:14 PM

hold on, I think I might be able to do this with a redirect trick on the account level

daveOP•4/3/25, 8:15 PM

https://developers.cloudflare.com/rules/url-forwarding/bulk-redirects/concepts/#url-redirects

daveOP•4/3/25, 8:15 PM

darn it

daveOP•4/3/25, 8:20 PM

With this configuration and Includes subdomains enabled, incoming requests to http://a.example.com/about and http://a.b.example.com/about would also match, in addition to the specified domain with no subdomain (https://example.com/about).

daveOP•4/3/25, 8:24 PM

ah ha!!

daveOP•4/3/25, 8:24 PM

It worked!

daveOP•4/3/25, 8:24 PM

This bulk redirect list rule effectively "blocks" all usage of pages.devpages.dev from what I can tell.

Ddave This bulk redirect list rule effectively "blocks" all usage of `pages.dev` from ...

daveOP•4/3/25, 8:28 PM

https://github.com/cloudflare/cloudflare-docs/issues/14839

Also documented here.

GitHub

Please document how to redirect all `*.pages.dev` domains in accoun...

Existing documentation URL(s) https://developers.cloudflare.com/pages/how-to/redirect-to-custom-domain/ What changes are you suggesting? I found a really nice trick for redirecting (effectively dis...

harryphilip1275•4/3/25, 8:54 PM

As soon as I change over to cloudflare and assign there name servers, my website stops working and has a message that says too many redirects, how do I fix that ?

daveOP•4/3/25, 9:03 PM

Is it possible to have Cloudflare Access act as a OAuth server for incoming requests from things like AWS EventBridge (API Connections)?

harryphilip1275•4/3/25, 9:16 PM

Cloudflare is so unreliable most times the nslookup gets the incorrect IP for teh website and occasionally it gets the right one

Hharryphilip1275 Cloudflare is so unreliable most times the nslookup gets the incorrect IP for t...

Hard@Work•4/3/25, 9:23 PM

What do you mean "the right one"?

Peps•4/3/25, 9:26 PM

it probably has nothing to do with you getting the 'incorrect ip', as you probably have Cloudflare's proxy enabled for your records, so you'll see CF's ip instead of your server as CF will act as a middleman

Peps•4/3/25, 9:27 PM

as for the 'too many redirects' error, make sure that the SSL mode on the Cloudflare dashboard is set to Full (Strict)Full (Strict) and that you have a valid SSL certificate installed on your webserver

Peps•4/3/25, 9:28 PM

Cloudflare has plenty of documentation to troubleshoot these very common errors, for example: https://developers.cloudflare.com/ssl/troubleshooting/too-many-redirects/

Zenith•4/3/25, 9:49 PM

hey, is there a way i can make my pages functions fail closed?

Zenith•4/3/25, 9:50 PM

in case of usage related failures

Payne•4/3/25, 9:52 PM

I have cloudflare Warp+ on my android device. I noticed there is a key with my ID in settings. I tried copying that key and pasting it on my cloudflare Warp application on MacOS but for some reason, I get "Invalid Key" error. Is it because WARP+ is not available on MacOS?

PPeps it probably has nothing to do with you getting the 'incorrect ip', as you probab...

harryphilip1275•4/3/25, 10:32 PM

Must I turn off the proxy ? Yes I have valid SSLs

Hharryphilip1275 Must I turn off the proxy ? Yes I have valid SSLs

Peps•4/3/25, 10:32 PM

if you have a valid SSL cert then you just have to switch the SSL mode to be full (strict)full (strict), at the SSL settings on the dashboard

PPeps if you have a valid SSL cert then you just have to switch the SSL mode to be `fu...

harryphilip1275•4/3/25, 10:38 PM

And the proxy on the A records ? Must I change those and turn off proxies ? it doesnt let me change SSL to strict as its only for Enterprise customers , when I turn off Proxies there is a recommendation to turn on proxies otherwise it exposes my IP but if it doesnt work then there is no point in cloudflare, this is 2nd time I have tried it and both times my website stopped working so now I am very leary of Cloudflare

Hharryphilip1275 And the proxy on the A records ? Must I change those and turn off proxies ? it...

Peps•4/3/25, 10:39 PM

ah right forgot strict is for ENT only, in that case regular

Full

Full

is fine.
You can leave proxy on, as you mentioned your SSL certs are correct. Just be aware that the ips you see when doing nslookup won't be yours, as that's expected.

PPeps ah right forgot strict is for ENT only, in that case regular `Full` is fine. You...

harryphilip1275•4/3/25, 10:41 PM

But then the site doesnt work , so now I have lost confidence in cloudflare I have tried this twice and both times my site stopped working so had ot revert back to my original nameservers and thne it worked again

Walshy•4/3/25, 10:42 PM

full strict isn't ent, origin-pull is ent only

Will this enforce Google Workspace as the login method, or will it only enforce the email address?

Similar Threads

Similar Threads

Similar Threads