4 ms·
I believe the secure email issue linked is exploitable by any MailChannels customer, not just Cloudflare Workers.
by drunkendog 3y ago
I believe the secure email issue linked is exploitable by any MailChannels customer, not just Cloudflare Workers.
- ttul 3y agoAll Workers API calls to MailChannels must send email from a domain that has a Domain Lockdown record authorizing the Worker by its CF-Worker header. Docs are here: https://support.mailchannels.com/hc/en-us/articles/4565898358413-Sending-Email-from-Cloudflare-Workers-using-MailChannels-Send-API https://support.mailchannels.com/hc/en-us/articles/456589835... Since you cannot forge the CF-Worker header in API requests (this header is added by Cloudflare's back end), it is not possible to send email for any domain that hasn't been locked down to your specific Worker.