4 ms·
So it's okay for users savvy-enough to write Workers to bypass other customers' security settings - but not for self-serve point-and-click customers to do the s
by buildbuildbuild 6y ago
So it's okay for users savvy-enough to write Workers to bypass other customers' security settings - but not for self-serve point-and-click customers to do the same. Interesting. I suppose users of Workers are more likely to have a verified payment method and thus are less likely to be engaged in suspicious behavior. Thanks for the link.
- kentonv 6y agoNo no no, you misunderstood. The whole post I linked you to was about why Workers does not allow forged Host headers. What Workers does allow is for you to send a request to a different hostname. In this case, the Host header matches the DNS lookup. So if the third party is on Cloudflare, the request will go through their Cloudflare security settings. It also allows, via the `resolveOverride` option, for you to do DNS lookup that doesn't match the Host header, as long as the Host header specifies a hostname within your domain. You can't forge a Host header specifying someone else's domain.