neon with cloudflare hyperdrive in hono.js using postgres.js

hello everyone, i'm having this error that I haven't quite know how to solve yet. it's related to using neon with postgres.js and hyperdrive i'm trying to set up a connection as follows:

import { Context } from 'hono';
import postgres from 'postgres';

const db = (c: Context) => {
  console.log('Connecting to database...');
  console.log(c.env.HYPERDRIVE.connectionString);

  const connectionString = c.env.HYPERDRIVE?.connectionString;

  return postgres(connectionString, {
    fetch_types: false
  });
};

export default db;

import { Context } from 'hono';
import postgres from 'postgres';

const db = (c: Context) => {
  console.log('Connecting to database...');
  console.log(c.env.HYPERDRIVE.connectionString);

  const connectionString = c.env.HYPERDRIVE?.connectionString;

  return postgres(connectionString, {
    fetch_types: false
  });
};

export default db;

but this is the output that I'm getting in the console:

Connecting to database...
postgresql://neondb_owner:*************@91a7****************d1e4c29.hyperdrive.local:5432/neondb?sslmode=disable
✘ [ERROR] PostgresError: connection is insecure (try using `sslmode=require`)

Connecting to database...
postgresql://neondb_owner:*************@91a7****************d1e4c29.hyperdrive.local:5432/neondb?sslmode=disable
✘ [ERROR] PostgresError: connection is insecure (try using `sslmode=require`)

i'm not sure what I'm supposed to do since the url provided by hyperdrive has sslmode=false. can anyone point me in the right direction?

4 Replies

xenial-black•5mo ago

Try setting sslmode to require: https://github.com/neondatabase/examples/tree/main/with-hyperdrive

GitHub

examples/with-hyperdrive at main · neondatabase/examples

Examples and code snippets demonstrating common ways of integrating Neon with various frameworks and languages. - neondatabase/examples

ambitious-aquaOP•5mo ago

i followed that guide using the command

npx wrangler hyperdrive create <NAME_OF_HYPERDRIVE_CONFIG> --connection-string="postgresql://neondb_owner:...@ep-...us-east-1.aws.neon.tech/neondb?sslmode=require"

npx wrangler hyperdrive create <NAME_OF_HYPERDRIVE_CONFIG> --connection-string="postgresql://neondb_owner:...@ep-...us-east-1.aws.neon.tech/neondb?sslmode=require"

to create my hyperdrive url but it always ends with sslmode=disable. i asked claude 4 about it and this is what is says:

This behavior is by design in Cloudflare Hyperdrive. When Hyperdrive creates the local connection string, it sets sslmode=disable because:

Hyperdrive handles SSL termination: The connection from your Worker to Hyperdrive's local proxy doesn't need SSL since it's internal to Cloudflare's infrastructure.
SSL is still used upstream: Even though your Worker connects to Hyperdrive without SSL, Hyperdrive itself maintains the SSL connection to your actual Neon database using the original connection string you provided (which had sslmode=require).
Security is maintained: The connection path is:

Worker → Hyperdrive (no SSL needed, internal)
Hyperdrive → Neon Database (SSL enabled, as specified in your original connection string)



The .hyperdrive.local hostname is a special internal hostname that routes through Cloudflare's network to the Hyperdrive service, which then connects to your actual database with the proper SSL configuration.
So while it might look concerning to see sslmode=disable in the generated URL, your database connections are still secure end-to-end. The SSL termination just happens at the Hyperdrive layer rather than at your Worker.

This behavior is by design in Cloudflare Hyperdrive. When Hyperdrive creates the local connection string, it sets sslmode=disable because:

Hyperdrive handles SSL termination: The connection from your Worker to Hyperdrive's local proxy doesn't need SSL since it's internal to Cloudflare's infrastructure.
SSL is still used upstream: Even though your Worker connects to Hyperdrive without SSL, Hyperdrive itself maintains the SSL connection to your actual Neon database using the original connection string you provided (which had sslmode=require).
Security is maintained: The connection path is:

Worker → Hyperdrive (no SSL needed, internal)
Hyperdrive → Neon Database (SSL enabled, as specified in your original connection string)



The .hyperdrive.local hostname is a special internal hostname that routes through Cloudflare's network to the Hyperdrive service, which then connects to your actual database with the proper SSL configuration.
So while it might look concerning to see sslmode=disable in the generated URL, your database connections are still secure end-to-end. The SSL termination just happens at the Hyperdrive layer rather than at your Worker.

that makes me think, maybe that error comes from the postgres.js library? it only happens on local though, so I'm not sure what to do

ambitious-aquaOP•5mo ago

in case anyone is wondering:

ambitious-aquaOP•5mo ago

wrangler dev --remote work perfectly

Gaming

Programming

neon with cloudflare hyperdrive in hono.js using postgres.js

Did you find this page helpful?