Skip to content
This repository was archived by the owner on Jun 6, 2024. It is now read-only.
This repository was archived by the owner on Jun 6, 2024. It is now read-only.

Cloudflare origins with CF-Connecting-IP #139

@mjhaller

Description

@mjhaller

We use Cloudworker locally, and it is great... but sometimes want to fetch a remote Cloudflare resource. Something like this:

Browser -> Local Cloudworker --fetch--> Cloudflare Proxy -> Origin
        |                       |                        |
    localhost:9000        example.thezebra.dev       example.com

This is a very contrived example, but you might imagine a useful reason to do this - say you using cloudworker as an api gateway, and developing one service locally but you want to access another one remotely.

Unfortunately this results in an error because Cloudworker sets CF-Connecting-IP which causes the Cloudflare proxy to return a 403 (DNS 1000 error page).

$ curl -I -X GET https://example.thezebra.dev/
HTTP/1.1 404 Not Found
Date: Tue, 04 Feb 2020 05:08:46 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d7669d0c09bed86af3ec2b0fb04a2f5421580792926; expires=Thu, 05-Mar-20 05:08:46 GMT; path=/; domain=.thezebra.dev; HttpOnly; SameSite=Lax; Secure
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 55fa20edbb9d7af8-MCI

^^^ the 404 is expected in this contrived example

$ curl -I -X GET https://example.thezebra.dev/ -H 'CF-Connecting-IP: ::1'
HTTP/1.1 403 Forbidden
Date: Tue, 04 Feb 2020 05:09:11 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Set-Cookie: __cfduid=d272f37bfebed8ecf1886e6b968932dd11580792951; expires=Thu, 05-Mar-20 05:09:11 GMT; path=/; domain=.thezebra.dev; HttpOnly; SameSite=Lax; Secure
Cache-Control: max-age=8
Expires: Tue, 04 Feb 2020 05:09:19 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 55fa21882a08fbb0-MCI

Would it make sense to add a way to suppress these headers?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions