Using `cf-connecting-ip` for duplicate-connection detection is getting into dangerous territory beca

Using

cf-connecting-ip

cf-connecting-ip

for duplicate-connection detection is getting into dangerous territory because of NAT and CGNAT, you might end up blocking 30 users because the CG-NAT'd IP is already connected from 1 user.

IIsaac McFadyen Using `cf-connecting-ip` for duplicate-connection detection is getting into dang...

Silvan•5/18/25, 7:07 PM

yea that was my fear. so i wondered if theres like some sort of client identifier. even if its just valid for the lifetime of a browser i guess

SSilvan basically for a game lobby thing. so a user cant just join multiple lobbies was ...

ZachHandley•5/18/25, 7:22 PM

you can also fingerprint

ZachHandley•5/18/25, 7:22 PM

"@thumbmarkjs"

ZachHandley•5/18/25, 7:22 PM

just don't be evil

ZachHandley•5/18/25, 7:22 PM

lol

ZachHandley•5/18/25, 7:22 PM

ip would be able to detect like, phone && web browser though, or you could implement basic authentication + detection for 100%

ZZachHandley "@thumbmarkjs"

Silvan•5/18/25, 7:28 PM

oh interesting!

Silvan•5/18/25, 7:29 PM

well tbf i could also use like
https://www.better-auth.com/docs/plugins/anonymous

i just didnt feel like putting a auth db in this but i why not i guess

Anonymous | Better Auth

Anonymous plugin for Better Auth.

SSilvan well tbf i could also use like https://www.better-auth.com/docs/plugins/anonymou...

ZachHandley•5/18/25, 7:40 PM

meh you could "authenticate" them by hashing their IP and fingerprint, or using them as individual identifiers, or

ZachHandley•5/18/25, 7:40 PM

or use like, appwrite

Angius•5/18/25, 10:43 PM

So, enabling analytics for Pages is super easy, but there's no way to do that for static Workers projects?

AAngius So, enabling analytics for Pages is super easy, but there's no way to do that fo...

ZachHandley•5/19/25, 1:57 AM

ms clarity is prolly your best bet

ZachHandley•5/19/25, 1:57 AM

static means pre-compiled, means there's no analytics to gather for a lot of things

Angius•5/19/25, 1:58 AM

Uh, what are you talking about? Cloudflare Pages lets me enable web analytics with a click of a button

Angius•5/19/25, 1:59 AM

Workers with static assets has no such option

Angius•5/19/25, 1:59 AM

Even though both do the exact same thing — serving static, precompiled assets

AAngius So, enabling analytics for Pages is super easy, but there's no way to do that fo...

Isaac McFadyenOP•5/19/25, 1:59 AM

There is but it's not on the Worker settings. It's in the settings of the custom domain.

Isaac McFadyenOP•5/19/25, 2:00 AM

You want these steps: https://developers.cloudflare.com/web-analytics/get-started/#sites-proxied-through-cloudflare

Angius•5/19/25, 2:02 AM

Which doesn't seem to work with subdomains for some reason. I can enable it automagically for

example.com

example.com

but not for

stuff.example.com

stuff.example.com

Angius•5/19/25, 2:02 AM

Which is something I could do with Pages that were given a subdomain

Angius•5/19/25, 2:03 AM

As in, a pages project deployed to

stuff.example.com

stuff.example.com

could have web analytics enabled with a click of a button

Isaac McFadyenOP•5/19/25, 2:03 AM

Hmm interesting, I understand why given it's not a subdomain zone but odd that you could on Pages then

Isaac McFadyenOP•5/19/25, 2:04 AM

Oh I bet Pages just deployed an analytics rule for you: https://developers.cloudflare.com/web-analytics/configuration-options/rules/

IIsaac McFadyen Oh I bet Pages just deployed an analytics rule for you: https://developers.cloud...

Chaika•5/19/25, 2:04 AM

It makes a JS Snippet and part of the Pages Asset Handler is injecting it via html rewriter

Chaika•5/19/25, 2:04 AM

Isaac McFadyenOP•5/19/25, 2:04 AM

Except free gets 0 rules...

CChaika It makes a JS Snippet and part of the Pages Asset Handler is injecting it via ht...

Isaac McFadyenOP•5/19/25, 2:04 AM

Oh I see :lul:

Isaac McFadyenOP•5/19/25, 2:04 AM

That's... interesting.

Angius•5/19/25, 2:06 AM

If so, then it means Pages let me bypass the free account limitations

Angius•5/19/25, 2:06 AM

Yeah lmao

Chaika•5/19/25, 2:06 AM

yea it doesn't, it just goes about it in a different way

IIsaac McFadyen Hmm interesting, I understand why given it's not a subdomain zone but odd that y...

Chaika•5/19/25, 2:08 AM

I thought though when you enable Web Analytics Automatic setup on the zone it enables it for all subdomains too, and that's why the rules existed, would have to test tho

Chaika•5/19/25, 2:10 AM

oop yea it does, it injects it on all subdomains too

Chaika•5/19/25, 2:11 AM

Even on free you can use Configuration Rules to disable/enable its injection, to get around not having any web analytic rules

AAngius Which doesn't seem to work with subdomains for some reason. I can enable it auto...

Chaika•5/19/25, 2:12 AM

^^ (enabling it on example.com enables it for the entire zone)

Angius•5/19/25, 2:13 AM

Can I somehow filter it by subdomains, though? So I can see visits for

foo.ex.com

foo.ex.com

and

bar.ex.com

bar.ex.com

separately, instead of just seeing the cumulative visits for

*.ex.com

*.ex.com

Angius•5/19/25, 2:14 AM

Ah, filter by site

Angius•5/19/25, 2:14 AM

Yeah, that works

Chaika•5/19/25, 2:15 AM

You can filter by Host(name)

Chaika•5/19/25, 2:15 AM

Site is the actual Web Analytics setups

Angius•5/19/25, 2:15 AM

Ah, that works too

Angius•5/19/25, 2:16 AM

Would be nice to just have a dropdown or something that automatically lists all subdomains with workers/pages associated to them

Angius•5/19/25, 2:17 AM

Instead of having to manually type in the full government name of each page lol

AAngius Would be nice to just have a dropdown or something that automatically lists all ...

Chaika•5/19/25, 2:19 AM

Scroll down to "Hosts" and you can select a specific one to filter to

Chaika•5/19/25, 2:20 AM

Angius•5/19/25, 2:20 AM

Huh? Where's that menu?

Chaika•5/19/25, 2:20 AM

bottom of the analytics view

Angius•5/19/25, 2:21 AM

Chaika•5/19/25, 2:21 AM

you need traffic lol

Chaika•5/19/25, 2:21 AM

it's based on actual requests

Using `cf-connecting-ip` for duplicate-connection detection is getting into dangerous territory beca

Similar Threads

Similar Threads

Similar Threads