nowfound

Life & fun · July 18, 2018

CSRF Protection Using Cloudflare Workers

Protect any origin from CSRF by checking if the Origin/Referer header match the Host header for "unsafe" methods. - csrf-protection-cloudflare-worker.js

CSRF Protection Using Cloudflare Workers launched on July 18, 2018 with 6 votes, #1,113 of 2,673 launches that month and more than 50% of that year's launches. The site was still online in September 2026, 8 years on.

Visit gist.github.com ↗Alternatives

What it does

It's a forbidden header name: https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name Of course you can set it by yourself as the attacker, but that's not the point of CSRF protection. Sorry to ask such a dumb question but. Let's say i deployed this on a worker, what would i need to add to the current html to get CSRF protection? You're probably not PayPal, so the form will never pass through your worker, thus there is nothing you and I can do to provide CSRF protection to that form. If you have the time, read this which explains CSRF:from gist.github.com

Does a similar job

all alternatives →
  • OS
    OpenWorkers – Self-hosted Cloudflare workers in RustJan 2026 · openworkers.com · ▲500

    I've been working on this for some time now, starting with vm2, then deno-core for 2 years, and recently rewrote it on rusty_v8 with Claude's help. OpenWorkers lets you run untrusted JS in V8 isolates on your own infrastructure. Same DX as Cloudflare Workers, no vendor lock-in. What works today: fetch, KV, Postgres bindings, S3/R2, cron scheduling, crypto.subtle. Self-hosting is a single docker-compose file + Postgres. Would love feedback on the architecture and what feature you'd want next.

  • Onepane2023 · onepane.ai · ▲330

    Cloud visibility for cross-functional teams

  • AS
    A Simple Website for Checking Cloudbleed from Browser's History2017 · cloudbleed.github.io · ▲132
  • CM
    Cloudflare marking all traffic from Pakistan as threat2012 · dl.dropbox.com · ▲30

    whenever I click through to a site managed through cloudflare I end up seeing a screen asking me to identify myself. This has happened often enough especially with HN articles that I just close some articles outright and read the discussion on HN instead. As an experiment I setup cloudflare for website of mine which gets majority of its traffic from Pakistan (where I am located). This is what I see https://dl.dropbox.com/u/8037186/cloudflare.png It basically shows cloudflare marking 100% of traffic from Pakistan as known threats. I would be interested to find out if its a common problem…

  • DNS rebinding protection for Express.js2018 · github.com · ▲30

    Express.js middleware for "Host" and "Referer" header validation to protect against DNS rebinding attacks. - brannondorsey/host-validation

  • WI
    Will It CORS? – an automatic CORS explainer2020 · willitcors.com · ▲152

    Test CORS online with our free CORS tester. Check CORS on any URL for free.

More life & fun this month

the category →

Source: Show HN post ↗

Launched alongside, July 2018

the whole month →