Cloudflare Developers•9mo ago

but even on a diff acct of mine which returns cf's geoip headers, still wrong

HHard@Work Does that happen if you create a new request?

ChaikaOP•4/28/25, 7:24 PM

a whole new request in the durable object?

Avi•4/28/25, 7:24 PM

that's what i'm doing and it doesn't work, @Hard@Work

Avi•4/28/25, 7:25 PM

i even creating the request in a

setTimeout

setTimeout

Avi•4/28/25, 7:25 PM

in case there was some magic about the subrequest coming from that particular incoming fetch request

Avi•4/28/25, 7:25 PM

of course they could still attribute it somehow

Avi•4/28/25, 7:26 PM

what i'm discovering, though, is that despite my jurisdiction being set to 'eu''eu', the DO is still being created in 'HK''HK'......

ChaikaOP•4/28/25, 7:26 PM

I remake the request I send to the Durable Object (not including the incoming headers) and the durable object just uses the url passed to it

CChaika a whole new request in the durable object?

Hard@Work•4/28/25, 7:27 PM

Yeah, I meant if the incoming Request has GeoIP attached, does it still pass it along if you create a new Request from scratch?

ChaikaOP•4/28/25, 7:28 PM

const newUrl = new URL("https://literallyanything/");
newUrl.searchParams.set("url", url.searchParams.get("url"));
var response = await durableObject.fetch(new Request(newUrl, { method: "GET" }));

Worker code

const url = new URL(request.url).searchParams.get("url");
if (!url) {
return new Response("url query parameter is required", { status: 400 });
}
return fetch(url, {
headers: {
"do-age": ${Date.now() - this.createdAt}${Date.now() - this.createdAt}
}
});

in durable object

ChaikaOP•4/28/25, 7:28 PM

aw should have used proper markdown for code, anyway, no explicit headers being passed/not passing the request

AAvi what i'm discovering, though, is that despite my jurisdiction being set to `'eu'...

ChaikaOP•4/28/25, 7:29 PM

how are you making your DO IDs? Are you using

env.MY_DURABLE_OBJECT.jurisdiction("eu").idFromName("my-name");
env.MY_DURABLE_OBJECT.jurisdiction("eu").newUniqueId()

and such?

Avi•4/28/25, 7:30 PM

more or less, yes

Avi•4/28/25, 7:30 PM

i create the binding tied to the jurisdiction

Avi•4/28/25, 7:30 PM

then call idFromNameidFromName on that binding

Avi•4/28/25, 7:30 PM

hmmmmmm i guess, the issue could be that I clone the incoming request

Avi•4/28/25, 7:30 PM

when i pass to the DO

Avi•4/28/25, 7:31 PM

and that includes whatever incoming stuff there is

Avi•4/28/25, 7:31 PM

        const durableObjectStub = binding.get(durableObjectId);
        return await durableObjectStub.fetch(request.clone());

        const durableObjectStub = binding.get(durableObjectId);
        return await durableObjectStub.fetch(request.clone());

Avi•4/28/25, 7:35 PM

yeah, confirmed, i have the jurisdiction set and yet, the locloc i get from cgi-bin/tracecgi-bin/trace shows HKHK

Avi•4/28/25, 7:35 PM

even weirder:

Avi•4/28/25, 7:35 PM

colo: IAD
loc: HK

Avi•4/28/25, 7:35 PM

in other words, we're running from a US data center (IAD), yet the location is still HK

AAvi in other words, we're running from a US data center (IAD), yet the location is s...

ChaikaOP•4/28/25, 7:36 PM

ignore the locloc, that's tied to GEOIP and is the same thing I was showing above (that original request geoip is what gets passed)

ChaikaOP•4/28/25, 7:38 PM

the colocolo being IAD for an eu jurisdiction is more interesting, somehow your jurisdiction isn't being set properly, you'd probably want to look further up on your namespace setup

ALECKS•4/28/25, 7:43 PM

Does Cloudflare have a KMS - like service?

ALECKS•4/28/25, 7:44 PM

Also, any news on worker containers release?

CChaika the `colo` being IAD for an eu jurisdiction is more interesting, somehow your ju...

Avi•4/28/25, 8:14 PM

sorry, IADIAD was for fedrampfedramp

Avi•4/28/25, 8:14 PM

my conern is precisely that the original request geoip is being passed

Avi•4/28/25, 8:15 PM

user is in HK -> requests to worker -> binds to DO -> DO fetch handler -> DO makes subrequest -> openai

Avi•4/28/25, 8:15 PM

somehow, the HK location is being passed all the way through there

Avi•4/28/25, 8:15 PM

you'd think that it wouldn't, though, since it's the DO making a "new" request, we're not just proxying...

Avi•4/28/25, 8:16 PM

to be more clear, if I fetch https://cloudflare.com/cdn-cgi/tracehttps://cloudflare.com/cdn-cgi/trace from within a DO, the locloc is set to the locloc of the original request

Avi•4/28/25, 8:16 PM

that's the behavior i'm surprised by

ChaikaOP•4/28/25, 8:17 PM

yea, it's just the geo data that gets through all the way to the end request

ChaikaOP•4/28/25, 8:17 PM

even if fetching different account workers-and-pages-discussions

Avi•4/28/25, 8:17 PM

how do i stop that though

ChaikaOP•4/28/25, 8:17 PM

I can repro the same in a more limited env/not passing any headers.

Avi•4/28/25, 8:17 PM

seems like a privacy issue, no?

AAvi how do i stop that though

ChaikaOP•4/28/25, 8:17 PM

I don't think you do. It seems purposeful/intentional

AAvi seems like a privacy issue, no?

ChaikaOP•4/28/25, 8:18 PM

it's just coarse geoip data, not the requesting ip or anything

Avi•4/28/25, 8:18 PM

i suppose so

Avi•4/28/25, 8:18 PM

do you know how that data is actually passed?

Avi•4/28/25, 8:18 PM

it doesn't seem like a header

Avi•4/28/25, 8:18 PM

perhaps its out of band, and re-created as a header on the incoming request?

AAvi perhaps its out of band, and re-created as a header on the incoming request?

ChaikaOP•4/28/25, 8:21 PM

yea, I think it's entirely out of your direct control/just gets passed through some other property to the Durable Object in the call. The Durable Object makes a request out, which goes through the CDN stuff, and the request out just contains the geo data stuff lingering. It's up to the customer's config on how it's used/if its put into a header/etc

Avi•4/28/25, 8:21 PM

right

ChaikaOP•4/28/25, 8:21 PM

could try using RPC instead of fetch to further ensure it's not any piece of the request

Avi•4/28/25, 8:21 PM

my mental model is that cloudflare has its own metadata attached to requests flowing within the CF network

Avi•4/28/25, 8:21 PM

and somewhere there is geo data

and if the receiving side has the geoIP enrichment feature enabled, they attach that data as headers to the incoming request just before delivering it to the worker

ChaikaOP•4/28/25, 8:22 PM

I've noticed this same behavior of cross-zone/acct fetches using worker's ip in cf-connecting-ip but not replacing the geodata for years, just never fully tested with Durable Objects and everything

but even on a diff acct of mine which returns cf's geoip headers, still wrong

Similar Threads

Similar Threads

Similar Threads