4 ms·

> You could do the same with any new VPS/cloud function provider. I'm not so sure this is true. Not long ago Cloudflare's CEO was making fun of people trying (

• judge2020 6y ago
  The thing is that it isn't being seen as a trusted source. The same global rate limits apply, and the `Cf-Connecting-Ip` (which is the one you should use for security) request header still can't be forged and is passed to the end website correctly.
  • tyingq 6y ago
    I have seen workers code that appears to remove Cf-Connecting-Ip prior to a fetch(), though no idea if that works. Maybe it just gets replaced with the workers ip? Like: router.route('/proxy/:url', '*', async (event) => { event.request.headers.delete('cf-connecting-ip'); event.request.headers.delete('x-real-ip'); return await fetch(event.parameters.url,event.request); Edit: Tried several variations of this. It doesn't work. The cf-connecting-ip header is always in the fetch request with the right data. It's a bit confusing because some of the Cloudflare tools don't show you all the headers.
• jsnell 6y ago
  > Cloudflare's CEO was making fun of people trying (and failing) to bypass Cloudflare's anti-bot measures Do you happen to have a link?
  • bassdropvroom 6y ago
    https://mobile.twitter.com/eastdakota/status/1273277839102656515 https://mobile.twitter.com/eastdakota/status/127327783910265...
    • jsnell 6y ago
      Thanks!