cloudflare-workers-security

Cloudflare Workers Security

Comprehensive security patterns for protecting Workers and APIs.

Quick Security Checklist

// 1. Validate all input
const validated = schema.parse(await request.json());

// 2. Authenticate requests
const user = await verifyToken(request.headers.get('Authorization'));
if (!user) return new Response('Unauthorized', { status: 401 });

// 3. Rate limit
const limited = await rateLimiter.check(clientIP);
if (!limited.allowed) return new Response('Too Many Requests', { status: 429 });

// 4. Add security headers
response.headers.set('X-Content-Type-Options', 'nosniff');
response.headers.set('X-Frame-Options', 'DENY');

// 5. Use HTTPS-only cookies
headers.set('Set-Cookie', 'session=xxx; Secure; HttpOnly; SameSite=Strict');

Critical Rules

1. Never trust client input - Validate and sanitize everything
2. Use secure secrets - Store in Wrangler secrets, never in code
3. Implement rate limiting - Protect against abuse
4. Set security headers - Prevent common attacks
5. Use CORS properly - Don't use * in production

Top 10 Security Errors

Vulnerability	Symptom	Prevention
Missing auth	Unauthorized access	Verify tokens on every request
SQL injection	Data breach	Use parameterized queries with D1
XSS	Script injection	Sanitize output, set CSP
CORS misconfiguration	Blocked requests or open access	Configure specific origins
Secrets in code	Exposed credentials	Use wrangler secret
Missing rate limits	DoS vulnerability	Implement per-IP limits
Weak tokens	Session hijacking	Use crypto.subtle for signing
Missing HTTPS	Data interception	Enforce HTTPS redirects
Insecure headers	Clickjacking, MIME attacks	Set security headers
Excessive permissions	Blast radius	Principle of least privilege

Authentication Patterns

JWT Verification

async function verifyJWT(token: string, secret: string): Promise<{ valid: boolean; payload?: unknown }> {
  try {
    const [headerB64, payloadB64, signatureB64] = token.split('.');

    // Verify signature
    const key = await crypto.subtle.importKey(
      'raw',
      new TextEncoder().encode(secret),
      { name: 'HMAC', hash: 'SHA-256' },
      false,
      ['verify']
    );

    const signature = Uint8Array.from(atob(signatureB64.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0));
    const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);

    const valid = await crypto.subtle.verify('HMAC', key, signature, data);
    if (!valid) return { valid: false };

    // Decode payload
    const payload = JSON.parse(atob(payloadB64.replace(/-/g, '+').replace(/_/g, '/')));

    // Check expiration
    if (payload.exp && Date.now() / 1000 > payload.exp) {
      return { valid: false };
    }

    return { valid: true, payload };
  } catch {
    return { valid: false };
  }
}