At the network level, we analyze over 1 trillion requests per day to understand reputation, patterns, and anomalies across more than 20% of the web.
令人惊讶的是:Cloudflare每天分析超过1000亿个请求,以理解超过20%的网络的声誉、模式和异常。
At the network level, we analyze over 1 trillion requests per day to understand reputation, patterns, and anomalies across more than 20% of the web.
令人惊讶的是:Cloudflare每天分析超过1000亿个请求,以理解超过20%的网络的声誉、模式和异常。
Cloudflare is an evil company which uses legitimate traffic to hide nefarious clients. They also have a history of taking no responsibility for hosting illegal content. Plus, they’re overselling their “privacy” stance. How can anyone trust a company that lets their clients host “Adobe Flash Updaters” in the name of “free speech”? Or that never answers questions unambiguously?
While the interface among services is HTTP, the networking is not. In fact, there is no networking! Unlike the typical “microservice architecture,” where services communicate over a network and can suffer from latency or interruption, service bindings are a zero-cost abstraction. When you deploy a service, we build a dependency graph of its service bindings, then package all of those services into a single deployment. When one service invokes another, there is no network delay; the request is executed immediately.This zero-cost model enables teams to share and reuse code within their organizations, without sacrificing latency or performance.
```toml type = "webpack" webpack_config = "webpack.config.js"
vars = { WORKER_ENV = "production", SENTRY_ENABLED = true }
[env.local]
vars = { WORKER_ENV = "local", SENTRY_ENABLED = false } ```
wrangler dev --env=local
```js // Auth Worker
export default { async fetch(request, env) { // Read x-custom-token header and make sure it matches SECRET_TOKEN if (request.headers.get('x-custom-token') === env.SECRET_TOKEN) { return new Response('Request allowed', { status: 200 }); } else { return new Response('x-custom-token does not match, request not allowed', { status: 403 }); } }, }; ```
```js // Gateway Worker
export default { async fetch(request, env) { // Fetch AUTH service and pass request const authResponse = await env.auth.fetch(request.clone());
// Return response from the AUTH service if the response status is not 200
// It would return 403 'x-custom-token does not match, request not allowed' response in such case
if (authResponse.status !== 200) {
return authResponse;
}
// Request allowed
// You can write application logic here
// In this case we delegate the logic to an `application` Worker
return await env.application.fetch(request)
}, }; ```
js
export default {
async tail(events) {
fetch("https://example.com/endpoint", {
method: "POST",
body: JSON.stringify(events),
})
}
}
bash
curl --request PUT \
--url https://api.cloudflare.com/client/v4/accounts/account_identifier/workers/scripts/script_name/schedules \
--header 'Content-Type: application/json' \
--header 'X-Auth-Email: ' \
--data '[{'\''cron'\'': '\''*/30 * * * *'\''}]'
``` wrangler dev --test-scheduled
$ curl "http://localhost:8787/__scheduled?cron=++++*" ```
js
export default {
async scheduled(event, env, ctx) {
ctx.waitUntil(doSomeTaskOnASchedule());
},
};
The Hibernation API allows a Durable Object that is not currently running an event handler, such as handling a WebSocket message, HTTP request, or alarm, to be removed from memory while keeping its WebSockets connected (“hibernation”).
Where such denial-of-service conditions occur, Cloudflare provides a bizarre “one more step” page inviting the visitor to complete a reCAPTCHA to access the site. Cloudflare claims that this is based on IP reputation, which constitutes a fallacious equivocation of IPs and users which has been found to be highly detrimental to Tor users in terms of the browseability of the web.
This is a good critique of Cloudflare CAPTCHAs. They are especially annoying when using a VPN (I use Mullvad) or unusual browser configurations. I wrote about how the Wayback Machine provides a good end-around the CAPTCHA deluge for pages which have been captured.
https://thenewleafjournal.com/using-web-archives-to-get-around-captchas/
Workers Types Generator
Hey! Thanks for raising this. As pointed out earlier in the thread, the workerd npm distribution is currently incompatible with Debian 11 "Bullseye", so won't work with any distro based off that (e.g. Ubuntu 20.04). Debian 12 "Bookworm" based distros (e.g. Ubuntu 22.04) should work, provided you apt install libc++1. We're working on getting a statically linked version of workerd published that should work on older Linux versions. No timeline on when this will be available though.
Figured it out. Cache-Control header is required.
js
const headers = { 'Cache-Control': 'public, max-age=604800' };
const request = new Request('https://foobar.com/')
const cacheResponse = new Response('bar',{ headers })
const cache = caches.default
await cache.put(request, cacheResponse)
const response = await cache.match(request);
🥳
```js import { connect } from 'cloudflare:sockets';
export default { async fetch(req: Request) { const gopherAddr = "gopher.floodgap.com:70"; const url = new URL(req.url);
try {
const socket = connect(gopherAddr);
const writer = socket.writable.getWriter()
const encoder = new TextEncoder();
const encoded = encoder.encode(url.pathname + "\r\n");
await writer.write(encoded);
return new Response(socket.readable, { headers: { "Content-Type": "text/plain" } });
} catch (error) {
return new Response("Socket connection failed: " + error, { status: 500 });
}
}
};
ts
connect(address: SocketAddress | string, options?: SocketOptions): Socket
declare interface Socket { get readable(): ReadableStream; get writable(): WritableStream; get closed(): Promise<void>; close(): Promise<void>; startTls(): Socket; }
declare interface SocketOptions { secureTransport?: string; allowHalfOpen: boolean; }
declare interface SocketAddress { hostname: string; port: number; } ```
none/unknown.fetch). In this case, the subrequest will be logged with a cache status, while the main request will be logged with none/unknown status (the main request did not hit cache, since Workers sits in front of cache).none/unknown.none/unknown.no-cache,private, or max-age=0 even though
Cloudflare originally preferred to cache the asset. BYPASS is returned when enabling Origin Cache-Control. Cloudflare also sets BYPASS when
your origin web server sends cookies in the response header.</td></tr><tr><td colspan="5" rowspan="1">REVALIDATED</td><td colspan="5" rowspan="1">The resource is served from Cloudflare’s cache but is stale. The resource was revalidated by
either an If-Modified-Since header or an If-None-Match header.</td></tr><tr><td colspan="5" rowspan="1">UPDATING</td><td colspan="5" rowspan="1">The resource was served from Cloudflare’s cache and was expired, but the origin web server
is updating the resource. UPDATING is typically only seen for very popular cached resources.</td></tr><tr><td colspan="5" rowspan="1">DYNAMIC</td><td colspan="5" rowspan="1">Cloudflare does not consider the asset eligible to cache and your Cloudflare settings do not
explicitly instruct Cloudflare to cache the asset. Instead, the asset was requested from the
origin web server. Use Page Rules to implement
custom caching options.</td></tr></tbody></table>
HTML templating and streaming response library for Worker Runtimes such as Cloudflare Workers.
js
function handleRequest(event: FetchEvent) {
return new HTMLResponse(pageLayout('Hello World!', html`
<h1>Hello World!</h1>
${async () => {
const timeStamp = new Date(
await fetch('https://time.api/now').then(r => r.text())
);
return html`<p>The current time is ${timeEl(timeStamp)}.</p>`
}}
`));
}
```js import type { EntryContext } from "@remix-run/cloudflare"; import { RemixServer } from "@remix-run/react"; import isbot from "isbot"; import { renderToReadableStream } from "react-dom/server";
const ABORT_DELAY = 5000;
const handleRequest = async ( request: Request, responseStatusCode: number, responseHeaders: Headers, remixContext: EntryContext ) => { let didError = false;
const stream = await renderToReadableStream( <RemixServer context={remixContext} url={request.url} abortDelay={ABORT_DELAY} />, { onError: (error: unknown) => { didError = true; console.error(error);
// You can also log crash/error report
},
signal: AbortSignal.timeout(ABORT_DELAY),
}
);
if (isbot(request.headers.get("user-agent"))) { await stream.allReady; }
responseHeaders.set("Content-Type", "text/html"); return new Response(stream, { headers: responseHeaders, status: didError ? 500 : responseStatusCode, }); };
export default handleRequest; ```
Conceptually, OHTTP is a simple protocol: end-to-end encrypted requests and responses are forwarded between client and server through a relay, decoupling who from what was sent
Pages offers developers the ability to define a _worker.js file in the output directory of your Pages project.
We use Javascript everywhere, since we solve the “issues” caused by Javascript rendering we want to build as much expertise as possible in this field. But for the other parts, we are taking advantage of CloudFlare’s distributed system for fast response and global scalability. While our uptime guarantees are supported by Digital Ocean’s cloud platform. We also use a myriad of other SaaS providers to maximize our effectiveness.
Stack of Prerender: - Javascript - CloudFlare - Digital Ocean - SaaS providers
one.one.one.one or 1dot1dot1dot1.cloudflare-dns.com and press Save.bash
curl --http2 -H 'accept: application/dns-json' https://1.1.1.1/dns-query?name=cloudflare.com --next --http2 -H 'accept: application/dns-json' https://1.1.1.1/dns-query?name=example.com
Determine how to cache a resource by setting TTLs, custom cache keys, and cache headers in a fetch request.
```js async function handleRequest(request) { const url = new URL(request.url);
// Only use the path for the cache key, removing query strings
// and always store using HTTPS, for example, https://www.example.com/file-uri-here
const someCustomKey = https://${url.hostname}${url.pathname};
let response = await fetch(request, { cf: { // Always cache this fetch regardless of content type // for a max of 5 seconds before revalidating the resource cacheTtl: 5, cacheEverything: true, //Enterprise only feature, see Cache API for other plans cacheKey: someCustomKey, }, }); // Reconstruct the Response object to make its headers mutable. response = new Response(response.body, response);
// Set cache control headers to cache on browser for 25 minutes response.headers.set('Cache-Control', 'max-age=1500'); return response; }
addEventListener('fetch', event => { return event.respondWith(handleRequest(event.request)); }); ```
Setting the cache level to Cache Everything will override the default cacheability of the asset. For time-to-live (TTL), Cloudflare will still rely on headers set by the origin.
js
// Force Cloudflare to cache an asset
fetch(event.request, { cf: { cacheEverything: true } });
Today, we’re excited to open up a beta of a third approach to keeping web browsing safe with Cloudflare Browser Isolation. Browser sessions run in sandboxed environments in Cloudflare data centers in 200 cities around the world, bringing the remote browser milliseconds away from the user so it feels like local web browsing.
Cloudflare introduces sandboxed web browsing. It's like a browser inside a browser, so we can rest assured that we won't be infected by the websites we visit
The best all-around performer is AWS CloudFront, followed closely by GitHub Pages. Not only do they have the fastest response times (median), they’re also the most consistent. They are, however, closely followed by Google Cloud Storage. Interestingly, there is very little difference between a regional and multi-regional bucket. The only reason to pick a multi-regional bucket would be the additional uptime guarantee. Cloudflare didn’t perform as well I would’ve expected.
Results of static webhosting benchmark (2020 May):
To add insult to injury I learn that when Cloudflare automatically detects an anomaly with your domain they permanently delete all DNS records. Mine won't be difficult to restore, but I'm not sure why this is necessary. Surely it would be possible for Cloudflare to mark a domain as disabled without irrevocably deleting it? Combined with the hacky audit log, I'm left with the opinion that for some reason Cloudflare decided to completely half-ass the part of their system that is responsible for deleting everything that matters to a user.
...and this is why some companies should not grow to become too big for the good of their customers.
Purging by single-file through your Cloudflare dashboard
This seems like the best way to purge files but I wonder if you can purge by domain or rather files rather than file.
Browse files stored on IPFS easily and securely with Cloudflare’s Distributed Web Gateway without downloading software. Serve your own content hosted on IPFS from a custom domain over HTTPs.
cloud storage service S3, which Amazon confirmed is experiencing “high error rates,”
Need to look at S3