Skip to content
This repository has been archived by the owner on Jun 6, 2024. It is now read-only.

Cloudflare origins with CF-Connecting-IP #139

Open
mjhaller opened this issue Feb 4, 2020 · 0 comments
Open

Cloudflare origins with CF-Connecting-IP #139

mjhaller opened this issue Feb 4, 2020 · 0 comments

Comments

@mjhaller
Copy link

mjhaller commented Feb 4, 2020

We use Cloudworker locally, and it is great... but sometimes want to fetch a remote Cloudflare resource. Something like this:

Browser -> Local Cloudworker --fetch--> Cloudflare Proxy -> Origin
        |                       |                        |
    localhost:9000        example.thezebra.dev       example.com

This is a very contrived example, but you might imagine a useful reason to do this - say you using cloudworker as an api gateway, and developing one service locally but you want to access another one remotely.

Unfortunately this results in an error because Cloudworker sets CF-Connecting-IP which causes the Cloudflare proxy to return a 403 (DNS 1000 error page).

$ curl -I -X GET https://example.thezebra.dev/
HTTP/1.1 404 Not Found
Date: Tue, 04 Feb 2020 05:08:46 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d7669d0c09bed86af3ec2b0fb04a2f5421580792926; expires=Thu, 05-Mar-20 05:08:46 GMT; path=/; domain=.thezebra.dev; HttpOnly; SameSite=Lax; Secure
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 55fa20edbb9d7af8-MCI

^^^ the 404 is expected in this contrived example

$ curl -I -X GET https://example.thezebra.dev/ -H 'CF-Connecting-IP: ::1'
HTTP/1.1 403 Forbidden
Date: Tue, 04 Feb 2020 05:09:11 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Set-Cookie: __cfduid=d272f37bfebed8ecf1886e6b968932dd11580792951; expires=Thu, 05-Mar-20 05:09:11 GMT; path=/; domain=.thezebra.dev; HttpOnly; SameSite=Lax; Secure
Cache-Control: max-age=8
Expires: Tue, 04 Feb 2020 05:09:19 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 55fa21882a08fbb0-MCI

Would it make sense to add a way to suppress these headers?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant