Cloudflare Developers•3mo ago

It's not like it's urgent to me, but it's still very exciting to see - coz it's long overdue 🙂

It's not like it's urgent to me, but it's still very exciting to see - coz it's long overdue

JJacob Marshall It's not like it's urgent to me, but it's still very exciting to see - coz it's ...

Brayden•10/7/25, 9:17 PM

am I allowed to say "this week" again?

Jacob MarshallOP•10/7/25, 9:43 PM

ZZetax Any updates on this? Would be a game changer https://github.com/cloudflare/worke...

plgingras88•10/7/25, 9:47 PM

I am in a hard release too, can't blame you Brayden ! Be proud it's a game changer feature.

BBrayden am I allowed to say "this week" again?

lambrospetrou•10/7/25, 10:18 PM

Brayden didn't learn yet not to give out ETAs

If there isn't an ETA, you cannot miss it.

11984 Ford Laser To answer the first one: `Deletes are counted as rows written.` https://develope...

lnow•10/8/25, 6:45 AM

I know how deletes are billed. What I don't know is if calling

deleteAll()

deleteAll()

which effectively removes DO is treated the same or not.

grrowl•10/8/25, 7:38 AM

does anyone know how to override the RPC Timeout? We're streaming data using ReadableStream over RPC, but the 100s time limit is too low for long-running AI responses.

ProxyReadTimeout

ProxyReadTimeout

is defined here: https://developers.cloudflare.com/api/resources/zones/subresources/settings/models/proxy_read_timeout/

Cloudflare API | Zones › Settings › ProxyReadTimeout

Interact with Cloudflare's products and services via the Cloudflare API

Marak•10/8/25, 8:09 AM

Is it possible to view an account wide “Service Map” or “Topology View” showing all Workers, Durable Objects, and their bindings/dependencies in the dashboard?

Currently, each individual Worker page in the dashboard displays its bindings and dependencies (Durable Objects, KV, R2, etc.), which is helpful, but there’s no system-wide view that connects them all.

MMarak Is it possible to view an account wide “Service Map” or “Topology View” showing ...

lambrospetrou•10/8/25, 10:01 AM

I don't think this exists right now, although it's been discussed a couple of times.

Llambrospetrou I don't think this exists right now, although it's been discussed a couple of ti...

Marak•10/8/25, 10:21 AM

With many Worker and Durable Object classes, it’s challenging to get a high-level picture of how everything fits together.

MMarak With many Worker and Durable Object classes, it’s challenging to get a high-leve...

lambrospetrou•10/8/25, 11:10 AM

The UI gets a lot of love lately, so I am sure (or I hope) this will get some attention at some point as well.

Nick•10/8/25, 1:48 PM

Is there any way to access the request ID of the worker that called the durable object from inside the handler somehow? Without having to manually plumb it in.

NNick Is there any way to access the request ID of the worker that called the durable ...

Larry•10/8/25, 2:12 PM

Are you using RPC for the call?

NNick Is there any way to access the request ID of the worker that called the durable ...

Larry•10/8/25, 2:13 PM

Where is the request ID coming from in the Worker? Headers on an HTTP Request?

Ivan•10/8/25, 2:49 PM

I am trying to create a worker with a durable object attached via Terraform. However, I keep on getting “Cannot create binding for class 'Aggregator' that is not exported by the script.” However, I do export it:

import { DurableObject } from 'cloudflare:workers';
export class Aggregator extends DurableObject { /* ... */ }
export default { async fetch() { /* ... */ } }

import { DurableObject } from 'cloudflare:workers';
export class Aggregator extends DurableObject { /* ... */ }
export default { async fetch() { /* ... */ } }

Is there something that is typically missed?

LLarry Are you using RPC for the call?

Nick•10/8/25, 2:52 PM

yes using RPC for the call. The requestID is the one that we get from the cloudflare header, which also ends up in the observability logs somehow

Ivan•10/8/25, 3:10 PM

Just maybe putting Terraform aside for a second, when I go via the UI and try to bind, it does not seem to see any durable objects exported in the script. I guess there is some misunderstanding from my side. What is going on here? How does one create durable objects?

IIvan Just maybe putting Terraform aside for a second, when I go via the UI and try to...

1984 Ford Laser•10/8/25, 10:32 PM

Have you added the binding to wrangler config?

IIvan Just maybe putting Terraform aside for a second, when I go via the UI and try to...

Marak•10/9/25, 12:15 AM

You'll want to ensure that the Durable Object class is exported in your main workerfile

// Export Durable Object
export { MyDurable } from './durables/MyDurable.js';

// Export Durable Object
export { MyDurable } from './durables/MyDurable.js';

You also need to configure the

wrangler

wrangler

config file in the project to have the binding.

  "durable_objects": {
    "bindings": [
      {
        "name": "MY_DURABLE",
        "class_name": "MyDurable"
      }
   ]

  "durable_objects": {
    "bindings": [
      {
        "name": "MY_DURABLE",
        "class_name": "MyDurable"
      }
   ]

xormask•10/9/25, 12:32 AM

I have a question about durable object pricing with RpcTarget. If my durable object has returned an RpcTarget (allowing me to amortize multiple calls within the same RPC session) am I correct to assume that while the RpcTarget stub is alive (hasn't been disposed of), the durable object must be actively running and billing me? I have a worker that makes multiple calls to a durable object, but between each call there's slow calls to an external service. If the durable object will be billing me for the whole rpc session, my guess is it would be cheaper to break into multiple shorter rpc sessions. Appreciate any clarifications!

Avi•10/9/25, 2:48 AM

what can be done to prevent a malicious actor from sending too many websocket messages to a durableobject? there seems to be some internal queue of incoming messages that's getting flooded (even before the requests reach my DO's code)

AAvi what can be done to prevent a malicious actor from sending too many websocket me...

Marak•10/9/25, 2:59 AM

You could try the Firewall API and create a new rule, https://developers.cloudflare.com/api/resources/firewall/subresources/rules/methods/create/

Cloudflare API | Firewall › Rules › Create Firewall Rules

Interact with Cloudflare's products and services via the Cloudflare API

Marak•10/9/25, 2:59 AM

What malicious actor is causing the problem @Avi?

MMarak You could try the Firewall API and create a new rule, https://developers.cloudfl...

Avi•10/9/25, 3:01 AM

this is apparently deprecated? to be clear the issue is the frequency of sending of traffic. i'm looking for a ratelimit, not to block a particular actor indefiniteyl

MMarak What malicious actor is causing the problem @Avi?

Avi•10/9/25, 3:01 AM

it's a videogame, so people who are looking to cheat

AAvi this is apparently deprecated? to be clear the issue is the frequency of sending...

Marak•10/9/25, 3:02 AM

Thanks. Yes. The new API appears to be: https://developers.cloudflare.com/ruleset-engine/rulesets-api/create/

We are using the legacy API in production at the moment. Idea is to make API call to CF to dynamicaly manage firewall rules to prevent connection from happening in the first place.

MMarak Thanks. Yes. The new API appears to be: https://developers.cloudflare.com/rulese...

Avi•10/9/25, 3:03 AM

right, i wouldn't want to prevent the connection entirely

Avi•10/9/25, 3:03 AM

just to say, limit the number of messages being sent to X per Y amount of time

Marak•10/9/25, 3:03 AM

RateLimit?

Avi•10/9/25, 3:04 AM

yes

Marak•10/9/25, 3:04 AM

There is a new built-in rate limiter here: https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/

We have custom RateLimit durable object here which has configurable locking settings

Avi•10/9/25, 3:05 AM

ooo that's cool, hadn't seen this before. although i doubt it would work for websocket messages

Marak•10/9/25, 3:05 AM

you can make a new DurableObject instance that acts a rate limiter, its very easy

Marak•10/9/25, 3:06 AM

and use custom business logic from your app

Avi•10/9/25, 3:06 AM

i don't follow. you're saying create a second DurableObject?

Marak•10/9/25, 3:06 AM

something like:

import { DurableObject } from 'cloudflare:workers';

let LOCK_TIMEOUT = 5000; // 5 seconds
let RATE_LIMIT_WINDOW = 200; // 200 milliseconds, now using stamina in cast system

// UserLock.js
export default class RateLimitkDurableObject extends DurableObject {
  constructor(state, env) {
    super(state, env);
    this.state = state;
    this.env = env;
  }

  async acquireLock() {

    // Check if user is locked
    const isLocked = await this.state.storage.get("isLocked");
    if (isLocked) {
      // check lastInteraction
      const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
      if (Date.now() - lastInteraction < LOCK_TIMEOUT) {
        throw new Error("User is currently locked");
      }
    }

    // Check rate limit (e.g., 1 request per 15 seconds)
    const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
    const now = Date.now();
    const rateLimitWindow = RATE_LIMIT_WINDOW;
    if (now - lastInteraction < rateLimitWindow) {
      let timeLeft = Math.ceil((rateLimitWindow - (now - lastInteraction)) / 1000);
      throw new Error(`Please try again in ${timeLeft} seconds.`);
    }

    // Acquire lock and update last interaction time
    await this.state.storage.put("isLocked", true);
    await this.state.storage.put("lastInteraction", now);

    return { status: "Lock acquired" };
  }

  async releaseLock() {
    // Release lock
    console.log("Releasing lock for user");
    await this.state.storage.put("isLocked", false);
    return { status: "Lock released" };
  }
}

import { DurableObject } from 'cloudflare:workers';

let LOCK_TIMEOUT = 5000; // 5 seconds
let RATE_LIMIT_WINDOW = 200; // 200 milliseconds, now using stamina in cast system

// UserLock.js
export default class RateLimitkDurableObject extends DurableObject {
  constructor(state, env) {
    super(state, env);
    this.state = state;
    this.env = env;
  }

  async acquireLock() {

    // Check if user is locked
    const isLocked = await this.state.storage.get("isLocked");
    if (isLocked) {
      // check lastInteraction
      const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
      if (Date.now() - lastInteraction < LOCK_TIMEOUT) {
        throw new Error("User is currently locked");
      }
    }

    // Check rate limit (e.g., 1 request per 15 seconds)
    const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
    const now = Date.now();
    const rateLimitWindow = RATE_LIMIT_WINDOW;
    if (now - lastInteraction < rateLimitWindow) {
      let timeLeft = Math.ceil((rateLimitWindow - (now - lastInteraction)) / 1000);
      throw new Error(`Please try again in ${timeLeft} seconds.`);
    }

    // Acquire lock and update last interaction time
    await this.state.storage.put("isLocked", true);
    await this.state.storage.put("lastInteraction", now);

    return { status: "Lock acquired" };
  }

  async releaseLock() {
    // Release lock
    console.log("Releasing lock for user");
    await this.state.storage.put("isLocked", false);
    return { status: "Lock released" };
  }
}

Ivan•10/9/25, 6:39 AM

When sharding a durable object, if one instance sets an alarm, is it guaranteed that the same instance will be invoked by the alarm?

Sstickman Hi @Larry had a question since you mention the fire and forget approach for maki...

ALECKS•10/9/25, 1:34 PM

You can configure that timeout to be longer, i forget the exact numbers, maybe 5 or 10 min? If you have jobs that need even more than that, then DOs alone aren't the right thing you might want to look into Containers, that's currently the only way to run long jobs in CF

Sstickman Hi @Larry had a question since you mention the fire and forget approach for maki...

Larry•10/9/25, 2:11 PM

You fire and forget to offload it to another DO whose only purpose is to send fetch requests, await responses, and send them back to the originating DO. The trick is to pass in the id of the original DO so this RequestProxy DO knows who to dial up again once it gets the response. Under load, this DO never hibernates but it's only one DO not all of your others.

I'm in the process of open sourcing a lot of pieces of our stack right now. The first drop is going to be a testing module that works great with WebSockets and simulates browser behavior (cookies, origin, etc.). After that, I may port our RequestProxy DO to the open source project. I'll come back here once it's published. Any day now for the testing, rpc, and utils modules. Just in the final steps of documentation editing.

1984 Ford Laser•10/9/25, 9:42 PM

Would this work:
DO A is acting as a WebSocket client, not using hibernation. DO B connects to DO A via WebSocket, DO A acts as the server and DO B as the client. Will DO B be able to hibernate, while A stays pinned to memory? In my scenario I'm already using DO A as a WS server for a different service but I want to direct data from A to B and using WS feels the best way to do it if B will hibernate

11984 Ford Laser Would this work: DO A is acting as a WebSocket client, not using hibernation. DO...

Brayden•10/9/25, 10:51 PM

DO websocket connections as clients can't hibernate, only as servers at the moment.

BBrayden DO websocket connections as clients can't hibernate, only as servers at the mome...

1984 Ford Laser•10/9/25, 11:03 PM

So in this instance I'd be better off having DO B act as the server yeah?

Larry•10/9/25, 11:56 PM

For DO to DO, wouldn't RPC be a better choice?

LLarry For DO to DO, wouldn't RPC be a better choice?

1984 Ford Laser•10/9/25, 11:59 PM

Yeah it would be, mostly looking to reduce request costs

11984 Ford Laser Yeah it would be, mostly looking to reduce request costs

Larry•10/10/25, 12:01 AM

I haven't done any of this myself but I believe that RPC has the concept of a "session". I don't think you pay for requests during a "session". I also believe that sessions timeout though so I'm guessing you have to sense when that happens and create a new session.

LLarry I haven't done any of this myself but I believe that RPC has the concept of a "s...

1984 Ford Laser•10/10/25, 12:04 AM

The session you talk about would be related to stubs and RpcTarget right? I don't like having to think about whether a new stub needs to be made and stuff. Currently, DO to DO RPC requires at least 2 requests per RPC call. If I use websockets, I make one request to connect, then I can send 20 messages for the price of 1

11984 Ford Laser The session you talk about would be related to stubs and RpcTarget right? I don'...

Larry•10/10/25, 12:18 AM

Fair enough. I still use fetch between DOs. Someday I'll start playing with RPC, RpcTarget, etc.

Peps•10/10/25, 12:55 AM

hm?

vcc•10/10/25, 2:26 AM

Did workers release a new version yesterday? My service got more errors than last full week.

import { DurableObject } from 'cloudflare:workers'; let LOCK_TIMEOUT = 5000; // 5 seconds let RATE_LIMIT_WINDOW = 200; // 200 milliseconds, now using stamina in cast system // UserLock.js export default class RateLimitkDurableObject extends DurableObject { constructor(state, env) { super(state, env); this.state = state; this.env = env; } async acquireLock() { // Check if user is locked const isLocked = await this.state.storage.get("isLocked"); if (isLocked) { // check lastInteraction const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0; if (Date.now() - lastInteraction < LOCK_TIMEOUT) { throw new Error("User is currently locked"); } } // Check rate limit (e.g., 1 request per 15 seconds) const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0; const now = Date.now(); const rateLimitWindow = RATE_LIMIT_WINDOW; if (now - lastInteraction < rateLimitWindow) { let timeLeft = Math.ceil((rateLimitWindow - (now - lastInteraction)) / 1000); throw new Error(`Please try again in ${timeLeft} seconds.`); } // Acquire lock and update last interaction time await this.state.storage.put("isLocked", true); await this.state.storage.put("lastInteraction", now); return { status: "Lock acquired" }; } async releaseLock() { // Release lock console.log("Releasing lock for user"); await this.state.storage.put("isLocked", false); return { status: "Lock released" }; } }