"Browser integrity check" as @kian pointed out, it's hiding under https://dash.cloudflare.com/[:acco

"Browser integrity check" as @kian pointed out, it's hiding under https://dash.cloudflare.com/[:accountid]/:[zone]/security and I was able to disable it for the endpoint via a simple Page Rule.

CCurtis Doty "Browser integrity check" as @kian pointed out, it's hiding under https://dash.c...

Curtis DotyOP•5/7/22, 1:11 AM

Rhetorical: But could that BIC Bypass Rule be defined within my Worker?!?

kian•5/7/22, 1:13 AM

Not entirely sure what you mean by within your Worker - BIC runs before the request hits your Worker so it'll be stopped before it can hit it.

Kkian Not entirely sure what you mean by within your Worker - BIC runs before the requ...

Curtis DotyOP•5/7/22, 1:17 AM

When I build a bound Worker, have the option to disable BIC for that Route.

CCurtis Doty When I build a bound Worker, have the option to disable BIC for that Route.

Erwin•5/7/22, 2:11 AM

I think there are a bunch of things we are thinking about when it comes to Workers like that. But they are a bit bigger picture. So will take a while.

Sebi•5/7/22, 2:39 AM

Any news on when Workers will be able to connect to Postgres, without a Cloudflare Tunnel in front?
Currently, the Postgres database connector requires Cloudflared to run in front of the database host, which is impossible for connecting to serverless platforms for obvious reasons

SSebi Any news on when Workers will be able to connect to Postgres, without a Cloudfla...

Erwin•5/7/22, 2:53 AM

Don’t the serverless platforms not have HTTP interfaces? Or do you mean managed hosting?

Erwin•5/7/22, 2:54 AM

The first hurdle is that we would need to support sockets on outgoing connections

Sebi•5/7/22, 2:54 AM

Yes, are outgoing TCP connections going to be supported at some point?

Erwin•5/7/22, 2:54 AM

Some point absolutely.

SSebi Any news on when Workers will be able to connect to Postgres, without a Cloudfla...

Isaac McFadyen•5/7/22, 2:55 AM

What Erwin says is totally correct, TCP connections are required. For now if you really need Postgres you can use a provider like Supabase or self-host PostgREST, both of which provide a REST API for Postgres.

EErwin Don’t the serverless platforms not have HTTP interfaces? Or do you mean managed ...

Sebi•5/7/22, 2:55 AM

Serverless relational databases don't support HTTP connections
e.g. CockroachCloud Serverless and PlanetScale; both require TCP

Isaac McFadyen•5/7/22, 2:55 AM

Personally I'm using Supabase and it's working very well so far.

SSebi Serverless relational databases don't support HTTP connections e.g. CockroachClo...

Isaac McFadyen•5/7/22, 2:56 AM

Yeah. With both of those your only option is to use Prisma's Data Proxy.

Isaac McFadyen•5/7/22, 2:56 AM

It's still in beta but supports both of those providers IIRC.

Isaac McFadyen•5/7/22, 2:56 AM

(it proxies database connections over HTTP using Prisma's client)

Erwin•5/7/22, 2:57 AM

The other challenge however is that Postgres creates a transaction context per connection. So if you open up a lot of connections, you kill your Postgres instance with OOM

Isaac McFadyen•5/7/22, 2:57 AM

Prisma's Data Proxy and PostgREST both solve that issue by using a single TCP connection and using HTTP to connect with your Worker.

IIsaac McFadyen Yeah. With both of those your only option is to use Prisma's Data Proxy.

Sebi•5/7/22, 2:58 AM

I'm currently using Prisma's dataproxy, but there's incompatibility with my fullstack framework of choice
Thanks for pointing out that Prisma's dataproxy is the only option, I will consider changing fullstack framework

SSebi I'm currently using Prisma's dataproxy, but there's incompatibility with my full...

Isaac McFadyen•5/7/22, 2:58 AM

Yeah, if you must use CockroachDB or PlanetScale then that's the only way, although I have heard both of those providers are looking into how best create an HTTP API on their end.

EErwin The other challenge however is that Postgres creates a transaction context per c...

Sebi•5/7/22, 3:03 AM

I'm very skeptical about Supabase's claims about their scalability, because it's pure Postgres underneath, and PG requires elbow grease to scale (it's far from the predictable scaling model that NewSQL databases such as CRDB offer
I know CF uses Postgres internally, so perhaps I'm wrong

IIsaac McFadyen Yeah, if you must use CockroachDB or PlanetScale then that's the only way, altho...

Sebi•5/7/22, 3:09 AM

Yes, and out of the two, CRDB IMHO taking the cake because it offers referential integrity while Planetscale doesn't
Planetscale has got a great developer experience, with rollbacks and branches, but my use case greatly benefits from referential integrity
I doubt Prisma's emulation of referential integrity for PlanetScale is reliable, because it is emulated on the client side and isolates can be killed AFAIK
I was thinking about using Deno Deploy in-between CF workers and CRDB, but Deno Deploy has some rough limits during their beta: https://deno.com/deploy/docs/pricing-and-limits

SSebi I'm very skeptical about Supabase's claims about their scalability, because it's...

Isaac McFadyen•5/7/22, 3:09 AM

The way I understand it, the max scalability of Postgres is dependent upon how powerful the master node is. For reads you can just add more replicas but for writes it's based on the master node's power.

IIsaac McFadyen The way I understand it, the max scalability of Postgres is dependent upon how p...

Sebi•5/7/22, 3:11 AM

There's a hard limit to how powerful the master can be, albeit high, it is a fundamental brick wall
Am looking for a solution that doesn't sacrifice the long term for the short term, to get more buy-in from stakeholders

Ddbdplayer might be a better question for Cloudflare staff here since it's such a sensitive...

Erwin•5/7/22, 3:34 AM

My first answer to that question is to do everything in your power to never be in that situation. Same with credit cards.

Erwin•5/7/22, 3:35 AM

Auth0 works great. Is free for small usage and reasonably priced for medium to large.

Erwin•5/7/22, 3:38 AM

Yeah.. we have a worker demo for that

Erwin•5/7/22, 3:39 AM

If I could remember what it was called..

Erwin•5/7/22, 3:39 AM

O-something. Need to find my work laptop I guess

Erwin•5/7/22, 3:41 AM

Well.. you still need to save something, that could derive the password if it isn’t secure enough.

Erwin•5/7/22, 3:42 AM

But let me go find my work laptop..

Ddbdplayer might be a better question for Cloudflare staff here since it's such a sensitive...

Hello, I’m Allie!•5/7/22, 3:45 AM

If possible, try to have the client hash & salt the password on their end, and then use it in your Worker.

Ddbdplayer there's only this really really ~really~ insecure authentication code lmao https...

Erwin•5/7/22, 3:58 AM

Oh gods.. I thought we added a big fat warning on that page..

"Browser integrity check" as @kian pointed out, it's hiding under https://dash.cloudflare.com/[:acco

Similar Threads

Similar Threads

Similar Threads