I'd expect any 403's to show up in the activity log which is on https://dash.cloudflare.com/?to=/:ac

I'd expect any 403's to show up in the activity log which is on https://dash.cloudflare.com/?to=/:account/:zone/security

kianOP•5/6/22, 4:39 PM

Bot Fight Mode, Managed Rules, your own Firewall Rules, etc - should all appear there

Kkian I'd expect any 403's to show up in the activity log which is on https://dash.clo...

Curtis Doty•5/6/22, 4:40 PM

Aha! Thank you. I was tripped up by the new UI.

kianOP•5/6/22, 4:42 PM

If it's Bot Fight Mode, there's only really 3 options:

1) Turn off BFM and do your own firewall rules to combat automated/unwanted traffic.
2) Use IP Access Rules to whitelist originating IP addresses (which is the only way to overrule BFM by bypassing it).
3) Go onto Enterprise + Bot Management.

kianOP•5/6/22, 4:42 PM

Depending how big your wallet is, 1 & 2 are probably the go-to.

Curtis Doty•5/6/22, 4:43 PM

I just created a Page Rule to disable BIC for just that endpoint. Testing now...

Curtis Doty•5/6/22, 4:48 PM

Yay, working perfectly now.

kianOP•5/6/22, 4:51 PM

kianOP•5/6/22, 4:51 PM

Cloudflare can be annoyingly good at detecting bots sometimes - I’ve broken lots of my APIs or Workers by turning on Bot Management

kianOP•5/6/22, 4:52 PM

BIC is given to all browsers if enabled - but whatever is accessing the endpoint isn’t a browser to be able to pass the challenge.

Walshy•5/6/22, 6:25 PM

The cache is only within a colo so it wouldn't be very good for rate limiting.

Walshy•5/6/22, 6:25 PM

Durable objects are definitely the thing to use for that.

CCurtis Doty They originally implied 200. But after I asked for more info, they are now sayin...

Erwin•5/6/22, 11:30 PM

Are you using a custom domain? Could you use your workers.dev domain?

EErwin Are you using a custom domain? Could you use your workers.dev domain?

Curtis Doty•5/6/22, 11:39 PM

Thanks so much for your help @evanderkoogh! It was an issue with the BIC. Which I missed due to the UI changes. A quick Page Rule bypassed the BIC, and all is well now!

Erwin•5/7/22, 1:01 AM

BIC?

Curtis Doty•5/7/22, 1:06 AM

"Browser integrity check" as @kian pointed out, it's hiding under https://dash.cloudflare.com/[:accountid]/:[zone]/security and I was able to disable it for the endpoint via a simple Page Rule.

CCurtis Doty "Browser integrity check" as @kian pointed out, it's hiding under https://dash.c...

Curtis Doty•5/7/22, 1:11 AM

Rhetorical: But could that BIC Bypass Rule be defined within my Worker?!?

kianOP•5/7/22, 1:13 AM

Not entirely sure what you mean by within your Worker - BIC runs before the request hits your Worker so it'll be stopped before it can hit it.

Kkian Not entirely sure what you mean by within your Worker - BIC runs before the requ...

Curtis Doty•5/7/22, 1:17 AM

When I build a bound Worker, have the option to disable BIC for that Route.

CCurtis Doty When I build a bound Worker, have the option to disable BIC for that Route.

Erwin•5/7/22, 2:11 AM

I think there are a bunch of things we are thinking about when it comes to Workers like that. But they are a bit bigger picture. So will take a while.

Sebi•5/7/22, 2:39 AM

Any news on when Workers will be able to connect to Postgres, without a Cloudflare Tunnel in front?
Currently, the Postgres database connector requires Cloudflared to run in front of the database host, which is impossible for connecting to serverless platforms for obvious reasons

SSebi Any news on when Workers will be able to connect to Postgres, without a Cloudfla...

Erwin•5/7/22, 2:53 AM

Don’t the serverless platforms not have HTTP interfaces? Or do you mean managed hosting?

Erwin•5/7/22, 2:54 AM

The first hurdle is that we would need to support sockets on outgoing connections

Sebi•5/7/22, 2:54 AM

Yes, are outgoing TCP connections going to be supported at some point?

Erwin•5/7/22, 2:54 AM

Some point absolutely.

SSebi Any news on when Workers will be able to connect to Postgres, without a Cloudfla...

Isaac McFadyen•5/7/22, 2:55 AM

What Erwin says is totally correct, TCP connections are required. For now if you really need Postgres you can use a provider like Supabase or self-host PostgREST, both of which provide a REST API for Postgres.

EErwin Don’t the serverless platforms not have HTTP interfaces? Or do you mean managed ...

Sebi•5/7/22, 2:55 AM

Serverless relational databases don't support HTTP connections
e.g. CockroachCloud Serverless and PlanetScale; both require TCP

Isaac McFadyen•5/7/22, 2:55 AM

Personally I'm using Supabase and it's working very well so far.

SSebi Serverless relational databases don't support HTTP connections e.g. CockroachClo...

Isaac McFadyen•5/7/22, 2:56 AM

Yeah. With both of those your only option is to use Prisma's Data Proxy.

Isaac McFadyen•5/7/22, 2:56 AM

It's still in beta but supports both of those providers IIRC.

Isaac McFadyen•5/7/22, 2:56 AM

(it proxies database connections over HTTP using Prisma's client)

Erwin•5/7/22, 2:57 AM

The other challenge however is that Postgres creates a transaction context per connection. So if you open up a lot of connections, you kill your Postgres instance with OOM

Isaac McFadyen•5/7/22, 2:57 AM

Prisma's Data Proxy and PostgREST both solve that issue by using a single TCP connection and using HTTP to connect with your Worker.

IIsaac McFadyen Yeah. With both of those your only option is to use Prisma's Data Proxy.

Sebi•5/7/22, 2:58 AM

I'm currently using Prisma's dataproxy, but there's incompatibility with my fullstack framework of choice
Thanks for pointing out that Prisma's dataproxy is the only option, I will consider changing fullstack framework

SSebi I'm currently using Prisma's dataproxy, but there's incompatibility with my full...

Isaac McFadyen•5/7/22, 2:58 AM

Yeah, if you must use CockroachDB or PlanetScale then that's the only way, although I have heard both of those providers are looking into how best create an HTTP API on their end.

EErwin The other challenge however is that Postgres creates a transaction context per c...

Sebi•5/7/22, 3:03 AM

I'm very skeptical about Supabase's claims about their scalability, because it's pure Postgres underneath, and PG requires elbow grease to scale (it's far from the predictable scaling model that NewSQL databases such as CRDB offer
I know CF uses Postgres internally, so perhaps I'm wrong

IIsaac McFadyen Yeah, if you must use CockroachDB or PlanetScale then that's the only way, altho...

Sebi•5/7/22, 3:09 AM

Yes, and out of the two, CRDB IMHO taking the cake because it offers referential integrity while Planetscale doesn't
Planetscale has got a great developer experience, with rollbacks and branches, but my use case greatly benefits from referential integrity
I doubt Prisma's emulation of referential integrity for PlanetScale is reliable, because it is emulated on the client side and isolates can be killed AFAIK
I was thinking about using Deno Deploy in-between CF workers and CRDB, but Deno Deploy has some rough limits during their beta: https://deno.com/deploy/docs/pricing-and-limits

SSebi I'm very skeptical about Supabase's claims about their scalability, because it's...

Isaac McFadyen•5/7/22, 3:09 AM

The way I understand it, the max scalability of Postgres is dependent upon how powerful the master node is. For reads you can just add more replicas but for writes it's based on the master node's power.

IIsaac McFadyen The way I understand it, the max scalability of Postgres is dependent upon how p...

Sebi•5/7/22, 3:11 AM

There's a hard limit to how powerful the master can be, albeit high, it is a fundamental brick wall
Am looking for a solution that doesn't sacrifice the long term for the short term, to get more buy-in from stakeholders

Ddbdplayer might be a better question for Cloudflare staff here since it's such a sensitive...

Erwin•5/7/22, 3:34 AM

My first answer to that question is to do everything in your power to never be in that situation. Same with credit cards.

Erwin•5/7/22, 3:35 AM

Auth0 works great. Is free for small usage and reasonably priced for medium to large.

I'd expect any 403's to show up in the activity log which is on https://dash.cloudflare.com/?to=/:ac

Similar Threads

Similar Threads

Similar Threads