Feature request: CloudFlare ZeroTrust authentication

[nebkat]

We use CloudFlare ZeroTrust for authenticating internal users. It would be great if the admin portal could be protected by ZeroTrust while links were publicly accessible, whether by two separate domains or a protected path. The fixed password is not particularly secure.

[github-actions]

👋 Here are some resources that may help:

📖 From docs: The current auth model relies entirely on NUXT_SITE_TOKEN (a static Bearer token/password) with no pluggable auth middleware. Docs only cover this single token approach — see deployment/workers.md and deployment/pages.md. There is no built-in support for Cloudflare ZeroTrust or any external IdP.

🔗 Related issues:

• Insecure authentication #275 (closed — "Insecure authentication"): Raised the same concern about the fixed token being insecure. Discussion may have relevant context.
• Users/Multiple tokens #104 (open — "Users/Multiple tokens"): Requests multi-user / multi-token support, which is a stepping stone toward pluggable auth. Labeled D1 — the planned D1 migration (Proposal: Migrate Core Storage to Cloudflare D1 + KV Cache #246) could enable more sophisticated auth models.
• Proposal: Migrate Core Storage to Cloudflare D1 + KV Cache #246 (open — "Migrate Core Storage to Cloudflare D1 + KV Cache"): Architecture proposal that would replace KV-only storage with D1. This could open the door for user management and integration with ZeroTrust Access (CF Access JWT validation at the Worker level).

Hope this helps! Feel free to provide more details if these do not address your case.

[miantiao-me]

Thank you for giving me some inspiration. I will refine this plan next.

[miantiao-me]

Please test based on the latest code. https://github.com/miantiao-me/Sink/blob/master/docs/cloudflare-access.md