cloudflare-workers-origin-zh/

[giscus[bot]]

cloudflare-workers-origin-zh/

This article is also available in English, at Incorporate Cloudflare Workers for origin fetching to safeguard the origin fetcher’s IP. WebP Cloud Services 的两大服务——Public Service 和 WebP Cloud 均使用了 Cloudflare 的 CDN，用于获得一个全球相对好看的延迟响应以及保

https://blog.webp.se/cloudflare-workers-origin-zh/

[sdvcrx]

这里的 CF-Connecting-IP 其实就是回源机器的 IP 吧，看文档和我测试都发现是这样。文章里面的IP 2a06:98c0:3600::103 是这个原因：

In cross-zone subrequests from one Cloudflare customer zone to another Cloudflare customer zone, the CF-Connecting-IP value will be set to the Worker client IP address '2a06:98c0:3600::103' for security reasons.

https://developers.cloudflare.com/fundamentals/reference/http-request-headers/#cf-connecting-ip-in-worker-subrequests

请求非Cloudflare托管的站点还是能看到回源IP的，所以用 CF workers 是不能保护回源IP的。

[n0vad3v]

不好意思我们隔了这么久才来回复这个评论。

确实 Cloudflare 的文档里面： https://developers.cloudflare.com/fundamentals/reference/http-request-headers/#cf-connecting-ip-in-worker-subrequests 有写到：

For Worker subrequests destined for a non-Cloudflare customer zone, the CF-Connecting-IP and x-real-ip headers will both reflect the client’s IP address, with only the x-real-ip header able to be altered.

我们重新测试了一下，使用域名 bennythink.com ，其中 NS 服务器信息如下：

bennythink.com.		86400	IN	NS	ns2.dnsowl.com.
bennythink.com.		86400	IN	NS	ns3.dnsowl.com.
bennythink.com.		86400	IN	NS	ns1.dnsowl.com.

属于上面提到的 "non-Cloudflare customer zone"，我们做了个 A 记录解析到 195.xxx.xxx.xxx

我们在 195.xxx.xxx.xxx 机器上运行了一个 echo server 来保存所有的请求日志，其中回源时，echo server 输出如下：

{
  "name": "echo-server",
  "hostname": "1314724c049a",
  "pid": 1,
  "level": 30,
  "host": {
    "hostname": "localhost",
    "ip": "::ffff:172.17.0.1",
    "ips": []
  },
  "http": {
    "method": "GET",
    "baseUrl": "",
    "originalUrl": "/",
    "protocol": "http"
  },
  "request": {
    "params": {},
    "query": {},
    "cookies": {},
    "body": {},
    "headers": {
      "host": "localhost:4000",
      "connection": "close",
      "accept-encoding": "gzip",
      "x-forwarded-for": "2a06:98c0:3600::103",
      "cf-ray": "88b3d367e65b2bc2-FRA",
      "x-forwarded-proto": "http",
      "cf-visitor": "{\"scheme\":\"http\"}",
      "cf-ew-via": "15",
      "cdn-loop": "cloudflare; subreqs=1",
      "accept": "image/avif,image/webp,image/apng,image/png,image/jpeg,image/gif,image/x-xbitmap,*/*;",
      "user-agent": "WebP Cloud Services/1.0",
      "cf-worker": "webp.se",
      "cf-connecting-ip": "2a06:98c0:3600::103"
    }
  },
  "environment": {
    "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
    "HOSTNAME": "1314724c049a",
    "NODE_VERSION": "20.11.0",
    "YARN_VERSION": "1.22.19",
    "HOME": "/root"
  },
  "msg": "Wed, 29 May 2024 04:43:50 GMT | [GET] - http://localhost:4000/",
  "time": "2024-05-29T04:43:50.858Z",
  "v": 0
}

在 Cloudflare Workers 的 Log （后台面板）里面看到的记录如下：

...
 "eventTimestamp": 1716957830379,
  "event": {
    "request": {
      "url": "https://xxx.webp.se/",
      "method": "POST",
      "headers": {
        "accept-encoding": "gzip, br",
        "cf-connecting-ip": "128.xxx.xxx.xxx",
        "cf-ipcountry": "DE",
        "cf-ray": "88b3d367ce952bc2",
        "cf-visitor": "{\"scheme\":\"https\"}",
        "connection": "Keep-Alive",
        "content-length": "240",
        "host": "originator.webp.se",
        "user-agent": "Go-http-client/2.0",
        "x-forwarded-proto": "https",
        "x-real-ip": "128.xxx.xxx.xxx"
      },
      "cf": {
        "clientTcpRtt": 6
...

其中这里的 "cf-connecting-ip": "128.xxx.xxx.xxx", 是我们 WebP Cloud Services 的真实 IP，"user-agent": "Go-http-client/2.0" 是因为我们回源时发给回源 Workers 的请求的程序是用 Go 写的。

但由于这个 Cloudflare Workers 的 Log 只能由我们自己看到，所以似乎对于源站而言，依然没法看到我们 WebP Cloud Services 的真实 IP 🤔

有些好奇你的测试环境是如何构建，可以做到源站看到回源的真实 IP 的。