Thanks. Yes. The new API appears to be: https://developers.cloudflare.com/ruleset-engine/rulesets-ap

MMarak Thanks. Yes. The new API appears to be: https://developers.cloudflare.com/rulese...

A

Avi•10/9/25, 3:03 AM

right, i wouldn't want to prevent the connection entirely

A

Avi•10/9/25, 3:03 AM

just to say, limit the number of messages being sent to X per Y amount of time

M

MarakOP•10/9/25, 3:03 AM

RateLimit?

A

Avi•10/9/25, 3:04 AM

yes

M

MarakOP•10/9/25, 3:04 AM

There is a new built-in rate limiter here: https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/

We have custom RateLimit durable object here which has configurable locking settings

A

Avi•10/9/25, 3:05 AM

ooo that's cool, hadn't seen this before. although i doubt it would work for websocket messages

M

MarakOP•10/9/25, 3:05 AM

you can make a new DurableObject instance that acts a rate limiter, its very easy

M

MarakOP•10/9/25, 3:06 AM

and use custom business logic from your app

A

Avi•10/9/25, 3:06 AM

i don't follow. you're saying create a second DurableObject?

M

MarakOP•10/9/25, 3:06 AM

something like:

import { DurableObject } from 'cloudflare:workers';

let LOCK_TIMEOUT = 5000; // 5 seconds
let RATE_LIMIT_WINDOW = 200; // 200 milliseconds, now using stamina in cast system

// UserLock.js
export default class RateLimitkDurableObject extends DurableObject {
  constructor(state, env) {
    super(state, env);
    this.state = state;
    this.env = env;
  }

  async acquireLock() {

    // Check if user is locked
    const isLocked = await this.state.storage.get("isLocked");
    if (isLocked) {
      // check lastInteraction
      const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
      if (Date.now() - lastInteraction < LOCK_TIMEOUT) {
        throw new Error("User is currently locked");
      }
    }

    // Check rate limit (e.g., 1 request per 15 seconds)
    const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
    const now = Date.now();
    const rateLimitWindow = RATE_LIMIT_WINDOW;
    if (now - lastInteraction < rateLimitWindow) {
      let timeLeft = Math.ceil((rateLimitWindow - (now - lastInteraction)) / 1000);
      throw new Error(`Please try again in ${timeLeft} seconds.`);
    }

    // Acquire lock and update last interaction time
    await this.state.storage.put("isLocked", true);
    await this.state.storage.put("lastInteraction", now);

    return { status: "Lock acquired" };
  }

  async releaseLock() {
    // Release lock
    console.log("Releasing lock for user");
    await this.state.storage.put("isLocked", false);
    return { status: "Lock released" };
  }
}

import { DurableObject } from 'cloudflare:workers';

let LOCK_TIMEOUT = 5000; // 5 seconds
let RATE_LIMIT_WINDOW = 200; // 200 milliseconds, now using stamina in cast system

// UserLock.js
export default class RateLimitkDurableObject extends DurableObject {
  constructor(state, env) {
    super(state, env);
    this.state = state;
    this.env = env;
  }

  async acquireLock() {

    // Check if user is locked
    const isLocked = await this.state.storage.get("isLocked");
    if (isLocked) {
      // check lastInteraction
      const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
      if (Date.now() - lastInteraction < LOCK_TIMEOUT) {
        throw new Error("User is currently locked");
      }
    }

    // Check rate limit (e.g., 1 request per 15 seconds)
    const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
    const now = Date.now();
    const rateLimitWindow = RATE_LIMIT_WINDOW;
    if (now - lastInteraction < rateLimitWindow) {
      let timeLeft = Math.ceil((rateLimitWindow - (now - lastInteraction)) / 1000);
      throw new Error(`Please try again in ${timeLeft} seconds.`);
    }

    // Acquire lock and update last interaction time
    await this.state.storage.put("isLocked", true);
    await this.state.storage.put("lastInteraction", now);

    return { status: "Lock acquired" };
  }

  async releaseLock() {
    // Release lock
    console.log("Releasing lock for user");
    await this.state.storage.put("isLocked", false);
    return { status: "Lock released" };
  }
}

import { DurableObject } from 'cloudflare:workers';

let LOCK_TIMEOUT = 5000; // 5 seconds
let RATE_LIMIT_WINDOW = 200; // 200 milliseconds, now using stamina in cast system

// UserLock.js
export default class RateLimitkDurableObject extends DurableObject {
  constructor(state, env) {
    super(state, env);
    this.state = state;
    this.env = env;
  }

  async acquireLock() {

    // Check if user is locked
    const isLocked = await this.state.storage.get("isLocked");
    if (isLocked) {
      // check lastInteraction
      const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
      if (Date.now() - lastInteraction < LOCK_TIMEOUT) {
        throw new Error("User is currently locked");
      }
    }

    // Check rate limit (e.g., 1 request per 15 seconds)
    const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
    const now = Date.now();
    const rateLimitWindow = RATE_LIMIT_WINDOW;
    if (now - lastInteraction < rateLimitWindow) {
      let timeLeft = Math.ceil((rateLimitWindow - (now - lastInteraction)) / 1000);
      throw new Error(`Please try again in ${timeLeft} seconds.`);
    }

    // Acquire lock and update last interaction time
    await this.state.storage.put("isLocked", true);
    await this.state.storage.put("lastInteraction", now);

    return { status: "Lock acquired" };
  }

  async releaseLock() {
    // Release lock
    console.log("Releasing lock for user");
    await this.state.storage.put("isLocked", false);
    return { status: "Lock released" };
  }
}

import { DurableObject } from 'cloudflare:workers';

let LOCK_TIMEOUT = 5000; // 5 seconds
let RATE_LIMIT_WINDOW = 200; // 200 milliseconds, now using stamina in cast system

// UserLock.js
export default class RateLimitkDurableObject extends DurableObject {
  constructor(state, env) {
    super(state, env);
    this.state = state;
    this.env = env;
  }

  async acquireLock() {

    // Check if user is locked
    const isLocked = await this.state.storage.get("isLocked");
    if (isLocked) {
      // check lastInteraction
      const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
      if (Date.now() - lastInteraction < LOCK_TIMEOUT) {
        throw new Error("User is currently locked");
      }
    }

    // Check rate limit (e.g., 1 request per 15 seconds)
    const lastInteraction = (await this.state.storage.get("lastInteraction")) || 0;
    const now = Date.now();
    const rateLimitWindow = RATE_LIMIT_WINDOW;
    if (now - lastInteraction < rateLimitWindow) {
      let timeLeft = Math.ceil((rateLimitWindow - (now - lastInteraction)) / 1000);
      throw new Error(`Please try again in ${timeLeft} seconds.`);
    }

    // Acquire lock and update last interaction time
    await this.state.storage.put("isLocked", true);
    await this.state.storage.put("lastInteraction", now);

    return { status: "Lock acquired" };
  }

  async releaseLock() {
    // Release lock
    console.log("Releasing lock for user");
    await this.state.storage.put("isLocked", false);
    return { status: "Lock released" };
  }
}

I

Ivan•10/9/25, 6:39 AM

When sharding a durable object, if one instance sets an alarm, is it guaranteed that the same instance will be invoked by the alarm?

Sstickman Hi @Larry had a question since you mention the fire and forget approach for maki...

A

ALECKS•10/9/25, 1:34 PM

You can configure that timeout to be longer, i forget the exact numbers, maybe 5 or 10 min? If you have jobs that need even more than that, then DOs alone aren't the right thing you might want to look into Containers, that's currently the only way to run long jobs in CF

Sstickman Hi @Larry had a question since you mention the fire and forget approach for maki...

L

Larry•10/9/25, 2:11 PM

You fire and forget to offload it to another DO whose only purpose is to send fetch requests, await responses, and send them back to the originating DO. The trick is to pass in the id of the original DO so this RequestProxy DO knows who to dial up again once it gets the response. Under load, this DO never hibernates but it's only one DO not all of your others.

I'm in the process of open sourcing a lot of pieces of our stack right now. The first drop is going to be a testing module that works great with WebSockets and simulates browser behavior (cookies, origin, etc.). After that, I may port our RequestProxy DO to the open source project. I'll come back here once it's published. Any day now for the testing, rpc, and utils modules. Just in the final steps of documentation editing.

1

1984 Ford Laser•10/9/25, 9:42 PM

Would this work:
DO A is acting as a WebSocket client, not using hibernation. DO B connects to DO A via WebSocket, DO A acts as the server and DO B as the client. Will DO B be able to hibernate, while A stays pinned to memory? In my scenario I'm already using DO A as a WS server for a different service but I want to direct data from A to B and using WS feels the best way to do it if B will hibernate

11984 Ford Laser Would this work: DO A is acting as a WebSocket client, not using hibernation. DO...

B

Brayden•10/9/25, 10:51 PM

DO websocket connections as clients can't hibernate, only as servers at the moment.

BBrayden DO websocket connections as clients can't hibernate, only as servers at the mome...

1

1984 Ford Laser•10/9/25, 11:03 PM

So in this instance I'd be better off having DO B act as the server yeah?

L

Larry•10/9/25, 11:56 PM

For DO to DO, wouldn't RPC be a better choice?

LLarry For DO to DO, wouldn't RPC be a better choice?

1

1984 Ford Laser•10/9/25, 11:59 PM

Yeah it would be, mostly looking to reduce request costs

11984 Ford Laser Yeah it would be, mostly looking to reduce request costs

L

Larry•10/10/25, 12:01 AM

I haven't done any of this myself but I believe that RPC has the concept of a "session". I don't think you pay for requests during a "session". I also believe that sessions timeout though so I'm guessing you have to sense when that happens and create a new session.

LLarry I haven't done any of this myself but I believe that RPC has the concept of a "s...

1

1984 Ford Laser•10/10/25, 12:04 AM

The session you talk about would be related to stubs and RpcTarget right? I don't like having to think about whether a new stub needs to be made and stuff. Currently, DO to DO RPC requires at least 2 requests per RPC call. If I use websockets, I make one request to connect, then I can send 20 messages for the price of 1

11984 Ford Laser The session you talk about would be related to stubs and RpcTarget right? I don'...

L

Larry•10/10/25, 12:18 AM

Fair enough. I still use fetch between DOs. Someday I'll start playing with RPC, RpcTarget, etc.

P

Peps•10/10/25, 12:55 AM

hm?

V

vcc•10/10/25, 2:26 AM

Did workers release a new version yesterday? My service got more errors than last full week.

11984 Ford Laser The session you talk about would be related to stubs and RpcTarget right? I don'...

L

lambrospetrou•10/10/25, 6:36 AM

Currently, DO to DO RPC requires at least 2 requests per RPC call

What do you mean 2 requests per RPC call? There should only be one round trip for a normal RPC call.

Llambrospetrou > Currently, DO to DO RPC requires at least 2 requests per RPC call What do you ...

1

1984 Ford Laser•10/10/25, 7:46 AM

Sorry I was including the call to the Worker as well

B

blindChicken•10/10/25, 1:35 PM

I'm seeing some weird behavior

happening in my Durable Objects "Live" logs. I'm seeing requests for an unrelated worker, that is a worker in a different project? It's a project that gets a lot of traffic compared to others, so I'm note sure if it is showing the traffic for all my workers or not. But there is a problem!

A

Alex Dahl•10/11/25, 7:03 PM

Has anyone else seen issues with ios 26 websockets and connecting to durable objects? I encountered this issue with one of my users. I think it might be an Apple issue, but I have only seen it once so far. They were using private relay

Apple forum thread: https://discussions.apple.com/thread/256142477?sortBy=rank

L

Lulu•10/12/25, 6:00 AM

I'm a little confused about how PITR works. The API says

getCurrentBookmark()

getCurrentBookmark()

and

getBookmarkForTime()

getBookmarkForTime()

return a

Promise<string>

Promise<string>

, but the example right below it shows it being used without a promise:

let now = new Date();
// restore to 2 days ago
let bookmark = ctx.storage.getBookmarkForTime(now - 2);
ctx.storage.onNextSessionRestoreBookmark(bookmark);

let now = new Date();
// restore to 2 days ago
let bookmark = ctx.storage.getBookmarkForTime(now - 2);
ctx.storage.onNextSessionRestoreBookmark(bookmark);

let now = new Date();
// restore to 2 days ago
let bookmark = ctx.storage.getBookmarkForTime(now - 2);
ctx.storage.onNextSessionRestoreBookmark(bookmark);

let now = new Date();
// restore to 2 days ago
let bookmark = ctx.storage.getBookmarkForTime(now - 2);
ctx.storage.onNextSessionRestoreBookmark(bookmark);

Assuming it returns a promise, how can I guarantee the bookmark I get is accurate?

let bookmark = await getCurrentBookmark();
// stuff may happen here while it is awaiting
this.sql.exec(/* omitted */);

let bookmark = await getCurrentBookmark();
// stuff may happen here while it is awaiting
this.sql.exec(/* omitted */);

let bookmark = await getCurrentBookmark();
// stuff may happen here while it is awaiting
this.sql.exec(/* omitted */);

let bookmark = await getCurrentBookmark();
// stuff may happen here while it is awaiting
this.sql.exec(/* omitted */);

G

geg•10/12/25, 6:31 AM

I can't help but read it as pain in the rear

L

Lulu•10/12/25, 6:34 AM

Looking up the workerd codebase, I found this:

// Get a bookmark for the current state of the database. Note that since this is async, the
// bookmark will include any writes in the current atomic batch, including writes that are
// performed after this call begins. It could also include concurrent writes that haven't happened
// yet, unless blockConcurrencyWhile() is used to prevent them.
kj::Promise<kj::String> getCurrentBookmark();

// Get a bookmark for the current state of the database. Note that since this is async, the
// bookmark will include any writes in the current atomic batch, including writes that are
// performed after this call begins. It could also include concurrent writes that haven't happened
// yet, unless blockConcurrencyWhile() is used to prevent them.
kj::Promise<kj::String> getCurrentBookmark();

// Get a bookmark for the current state of the database. Note that since this is async, the
// bookmark will include any writes in the current atomic batch, including writes that are
// performed after this call begins. It could also include concurrent writes that haven't happened
// yet, unless blockConcurrencyWhile() is used to prevent them.
kj::Promise<kj::String> getCurrentBookmark();

// Get a bookmark for the current state of the database. Note that since this is async, the
// bookmark will include any writes in the current atomic batch, including writes that are
// performed after this call begins. It could also include concurrent writes that haven't happened
// yet, unless blockConcurrencyWhile() is used to prevent them.
kj::Promise<kj::String> getCurrentBookmark();

But it is hard to tell what "concurrent writes that haven't happened yet" means. Is it saying after the callback returns, the bookmark will be accurate?

H

Harrison Lo•10/12/25, 6:50 PM

I wonder if each Durable Object will come with its own R2 binding too in the future

LLulu I'm a little confused about how [PITR](https://developers.cloudflare.com/durable...

L

lambrospetrou•10/13/25, 9:41 AM

Configures the Durable Object so that the next time it restarts, it should restore its storage to exactly match what the storage contained at the given bookmark. After calling this, the application should typically invoke ctx.abort() to restart the Durable Object, thus completing the point-in-time recovery.

As the docs say,

onNextSessionRestoreBookmark

onNextSessionRestoreBookmark

works on the next restart, so you need to kill the DO for the restore to happen.

As mentioned multiple times, I suggest you always

await

await

explicitly any async operation. The example there probably depends on implicit transactions, but just await in your code to be able to reason about things.

A

ALECKS•10/13/25, 1:33 PM

If I want to do a "fire and forget" on a DO method, is there any functional difference between:

ctx.waitUntil(doSomething())

ctx.waitUntil(doSomething())

and

setting an alarm in, say 100ms, return, then let the DO
```
doSomething()
```
```
doSomething()
```
as a result of the alarm
?

Llambrospetrou > Configures the Durable Object so that the next time it restarts, it should res...

L

Lulu•10/13/25, 6:33 PM

Thanks. Just to be clear, you are saying by awaiting the bookmark in the example below, and then restoring the database to that bookmark, the transaction that happened after is guaranteed to be absent from the restored version?

let bookmark = await getCurrentBookmark();
// stuff may happen here while it is awaiting
this.sql.exec(/* omitted */);

let bookmark = await getCurrentBookmark();
// stuff may happen here while it is awaiting
this.sql.exec(/* omitted */);

let bookmark = await getCurrentBookmark();
// stuff may happen here while it is awaiting
this.sql.exec(/* omitted */);

let bookmark = await getCurrentBookmark();
// stuff may happen here while it is awaiting
this.sql.exec(/* omitted */);

LLulu Thanks. Just to be clear, you are saying by awaiting the bookmark in the exampl...

L

lambrospetrou•10/13/25, 7:53 PM

If you await, then the comment is wrong, since nothing will happen until the promise to get the bookmark resolves.
Any write happening after you got your bookmark is not included in the version pointed by that bookmark.

E

Earl•10/13/25, 8:20 PM

When binding to a DO in another worker while using enviroments using { "environment": "staging", "script_name": "api", ... } does not work
error: Cannot create binding for class in script 'api' that does not exist. [code: 10061]

The following binding does work: { "script_name": "api-staging", ... }

Which is expected - but why can't I use the environment property alternatively? What else is its use?

A

ALECKS•10/13/25, 9:03 PM

The docs say that DurableObject KV storage is Synchronous: https://developers.cloudflare.com/durable-objects/api/sqlite-storage-api/#synchronous-kv-api
However, the generated typescript types show that

ctx.storage.get()

ctx.storage.get()

returns a Promise.

Is this a bug or am I missing something?

AALECKS The docs say that DurableObject KV storage is Synchronous: https://developers.cl...

I

Isaac McFadyen•10/13/25, 9:09 PM

That's for the SQLite KV API, are you looking at the types for the original KV storage in DOs perhaps?

AALECKS The docs say that DurableObject KV storage is Synchronous: https://developers.cl...

1

1984 Ford Laser•10/13/25, 9:12 PM

ctx.storage.kv.get()

ctx.storage.kv.get()

is the sync API (in SQLite DOs)

1

1984 Ford Laser•10/13/25, 9:12 PM

ctx.storage.get()

ctx.storage.get()

is the old async API

IIsaac McFadyen That's for the SQLite KV API, are you looking at the types for the original KV s...

A

ALECKS•10/13/25, 9:13 PM

Ah thank you, missed that

.kv

.kv

BBrayden am I allowed to say "this week" again?

S

sebws•10/14/25, 1:43 AM

did this happen?

EEarl When binding to a DO in another worker while using enviroments using { "environm...

L

lambrospetrou•10/14/25, 6:53 AM

Your worker names are different for each environment right? If you remove the

environment

environment

and keep the

script_name

script_name

with the correct worker name does it work? The error says there isn't any worker with the name

api

api

which is correct, since you say the worker is

api-staging

api-staging

.

Environments are not a semantic thing all things understand, I personally see it mostly as a wrangler thing to group your configuration, but then the resources are identified by their own IDs/names.

Llambrospetrou Your worker names are different for each environment right? If you remove the `e...

E

Earl•10/14/25, 9:11 AM

Since wrangler automatically suffixes the env name to the worker name it does make sense. What doesn't make sense to me is that the DO binding configuration has an environment property:
https://developers.cloudflare.com/workers/wrangler/configuration/#durable-objects
What does it do?

Cloudflare Docs

Configuration

Use a configuration file to customize the development and deployment setup for your Worker project and other Developer Platform products.

EEarl Since wrangler automatically suffixes the env name to the worker name it does ma...

L

lambrospetrou•10/14/25, 9:41 AM

Not sure, but my guess would be it's from the deprecated "service environments" thing that was tried out a few years ago.

BBrayden Durable Objects will have a built in Studio in the dashboard next week if this f...

C

christianklotz•10/14/25, 9:51 AM

Is this GA? My Durable Objects dashboard looks like it still uses the previous design

Llambrospetrou Not sure, but my guess would be it's from the deprecated "service environments" ...

E

Earl•10/14/25, 10:01 AM

Ah alright, thanks!

I

icemelt_melt•10/14/25, 11:14 AM

I want to know will ever Durable Objects or D1 come to Dubai region?

N

Nick•10/14/25, 12:57 PM

Has anyone managed to successfully wrap durable objects classes?

I am looking at how sentry does it:
https://github.com/getsentry/sentry-javascript/blob/develop/packages/cloudflare/src/durableobject.ts
And it's really rather complex!

We want to wrap all the methods on our durable object in an AsyncLocalStorage context but keep getting errors with the wrong

this

this

this

this being bound, or shared IO stuff, or private member access. We tried doing it with a proxy, and then copying the sentry approach. Both got close but had some error conditions like

Cannot perform I/O on behalf of a different Durable Object

Cannot perform I/O on behalf of a different Durable Object

Cannot perform I/O on behalf of a different Durable Object

Cannot perform I/O on behalf of a different Durable Object

or

Cannot read private member #_name from an object whose class did not declare it

Cannot read private member #_name from an object whose class did not declare it

Cannot read private member #_name from an object whose class did not declare it

Cannot read private member #_name from an object whose class did not declare it

.

GitHub

sentry-javascript/packages/cloudflare/src/durableobject.ts at devel...

Official Sentry SDKs for JavaScript. Contribute to getsentry/sentry-javascript development by creating an account on GitHub.