Repository navigation
Cloudflare Worker: drop SITE_KEY injection and ORIGIN_URL from the install guide - #116
Merged
Merged
Conversation
…stall The worker no longer rewrites HTML or takes an origin URL, so the guide was telling customers to configure two things that no longer exist and to build a DNS topology they no longer need. - The "Deployment modes" section is gone. There is one install: add the two script tags to your own pages. Auto-inject, HTMLRewriter and SITE_KEY are removed from the product, so the page says so once and moves on. - ORIGIN_URL and the second grey-clouded origin.<domain> record are gone. Allowed requests leave the worker with fetch(request), which on a route goes to the origin named by the hostname's own DNS record. One hostname, nothing to configure, no loop to avoid. A new section explains it. - The wrangler.toml example is now the whole file: PROTECT_URL plus [secrets] required = ["CLIENT_JWT"]. Documents that the shipped PROTECT_URL placeholder is deliberately not a URL (the worker logs an error and passes traffic through until it is replaced), and that deploy refuses to run until CLIENT_JWT is set. - The verify commands ran against workers.dev. That cannot work any more: a workers.dev URL has no origin behind it, so an allowed request re-enters the worker and Cloudflare returns Error 1042. They now run against the route. - "Excluding static assets" described the [assets] binding and run_worker_first, both removed. Which paths are checked now comes only from the protected-path list in the portal, refreshed every 60s with no redeploy. Added to the portal settings checklist. - Notes the bundle tag carries no integrity attribute on purpose, and moves the CSP note out of the deleted auto-inject section. - worker.js is ~105 KB now, not ~60 KB. Verified: astro build passes, 417 pages. The rendered page has no reference to auto-inject, HTMLRewriter, run_worker_first or two hostnames; the only SITE_KEY and ORIGIN_URL mentions are the two "this was removed" notes.
✅ Deploy Preview for peaceful-pothos-9e62ce ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This was referenced Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
The Cloudflare Worker guide told customers to set up two things that no longer exist, and to build a DNS layout they no longer need. The worker shipped today (0.1.5, now live on
packages.prosopo.io) removed both.1. No more auto-inject. The page led with "Auto-inject (recommended)": set
SITE_KEYand the worker rewrites every HTML response to add the Protect script tags for you. That mode has been removed from the worker. There is now one install — add the two tags to your own pages — and the page says the old mode is gone rather than pretending it was never there.2. No more
ORIGIN_URL, and no second hostname. The guide told customers they needed two hostnames:wwworange-clouded for the worker, plus a grey-cloudedorigin.<domain>for the worker to forward to, with a warning about causing a loop if they got it wrong.None of that is true now. Allowed requests leave the worker with
fetch(request), which on a route goes to the origin named by the hostname's own DNS record. So the customer's existingwwwrecord is the origin: one hostname, nothing to configure, no loop to avoid. There's a new section explaining this, and the old two-hostname instructions are gone.3. The verify commands could not have worked. They ran against a
workers.devURL. Aworkers.devdeployment has no origin behind it, so an allowed request re-enters the worker and Cloudflare returns Error 1042 — I hit this while testing the released tarball. The commands now run against the route, and the page explains whyworkers.devcan't be smoke-tested end to end.4. Config example is now the real file.
PROTECT_URLplus[secrets] required = ["CLIENT_JWT"], which is all of it. Two behaviours that were undocumented and surprising are now written down: the shippedPROTECT_URLplaceholder is deliberately not a URL, so until you replace it the worker logs an error and passes traffic through rather than failing your site; andwrangler deploynow refuses to deploy untilCLIENT_JWTis set.5. Static-asset exclusion was describing a removed feature. It documented the
[assets]binding andrun_worker_first. Which paths get checked now comes only from the protected-path list in the portal, which the worker refreshes every 60 seconds with no redeploy. That's now a row in the portal settings checklist, with thewrangler tailline that tells you the list is working.Smaller: the bundle tag's missing
integrityattribute is explained (we replace the bundle every release, so a pinned hash would break customer pages), the CSP note moved out of the deleted auto-inject section into the install it still applies to, andworker.jsis ~105 KB now rather than ~60 KB.Test coverage
astro buildpasses — 417 pages. I checked the rendered HTML rather than only the source: it contains no reference to auto-inject,HTMLRewriter,run_worker_firstor two hostnames, and the onlySITE_KEYandORIGIN_URLmentions are the two "this was removed" notes. The new sections and the Error 1042 note render.Only the English page carries this config detail — no other locale has
cloudflare-worker.mdx— so there are no translations to follow up.Why now
The 0.1.5 worker is published and going to a customer. The docs were describing 0.1.1 behaviour from August, so anyone following them would have configured a var the worker ignores and built a DNS record it doesn't use.
🤖 Generated with Claude Code