cloudflare-workers-security
Cloudflare Workers Security delivers production patterns for protecting APIs and Workers through authentication verification, request rate limiting, input validation, and security headers. It covers JWT and API key validation, CORS configuration, and defends against common vulnerabilities like injection, XSS, and unauthorized access.
Cloudflare Workers Security provides authentication, rate limiting, and input validation patterns to protect your APIs.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-25
Cloudflare Workers Security provides authentication, rate limiting, and input validation patterns to protect your APIs. Cloudflare Workers Security delivers production patterns for protecting APIs and Workers through authentication verification, request rate limiting, input validation, and security headers. It covers JWT and API key validation, CORS configuration, and defends against common vulnerabilities like injection, XSS, and unauthorized access.
Use it when
- Cloudflare Workers Security provides patterns for JWT verification and API key validation as middleware.
- Cloudflare Workers Security covers safe CORS configuration by setting appropriate Access-Control headers in responses.
Verify before relying
Read SKILL.md below before installing (12 files). Open directory: indexed for reading, not audited.
Install
secondsky/claude-skills/cloudflare-workers-security · repository language: TypeScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are the security best practices for Cloudflare Workers?
Cloudflare Workers Security recommends a layered approach: implement authentication (JWT or API keys) at entry points, validate all inputs rigorously, set restrictive security headers, enable rate limiting to prevent DoS, and use environment variables for secrets. The skill covers production patterns for each layer, from middleware setup to vulnerability prevention, ensuring your Workers APIs resist common attacks like injection, XSS, and unauthorized access.
How do I add authentication to Cloudflare Workers?
Cloudflare Workers Security provides patterns for JWT verification and API key validation as middleware. Extract tokens from Authorization headers, verify signatures against your key material, and reject invalid requests early. The skill includes examples for both JWT and API key approaches, allowing you to choose based on your architecture. Secrets should be stored in environment variables, never hardcoded.
How can I fix CORS errors in Cloudflare Workers?
Cloudflare Workers Security covers safe CORS configuration by setting appropriate Access-Control headers in responses. Define allowed origins explicitly (avoid wildcards in production), specify permitted methods and headers, and handle preflight OPTIONS requests. The skill shows how to validate origin headers and configure credentials safely, preventing both access errors and security gaps from overly permissive policies.
What rate limiting and DoS protection does Cloudflare Workers offer?
Cloudflare Workers Security implements rate limiting through request counting and sliding windows, rejecting excess traffic with 429 responses. Combine this with security headers and input validation to defend against DoS. The skill provides patterns for per-IP or per-user limits, durable objects for state, and integration with Cloudflare's edge protections to create defense-in-depth against volumetric and application-layer attacks.
How do I prevent XSS and injection attacks in Cloudflare Workers?
Cloudflare Workers Security emphasizes input validation—sanitize and type-check all request data before use. Set Content-Security-Policy and X-Content-Type-Options headers to limit XSS impact. For database queries, use parameterized statements. The skill covers validation patterns, header configuration, and common injection vectors (SQL, command, template), helping you block malicious payloads at the Worker boundary before they reach downstream systems.
How should I manage API keys and secrets securely in Workers?
Cloudflare Workers Security stores secrets in environment variables and Durable Objects, never in code or logs. Rotate keys regularly, use short expiration windows, and audit access. The skill shows how to load secrets at runtime, validate API keys against a store, and implement key versioning. Combine with rate limiting per key and monitoring to detect compromised credentials early.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Cloudflare Workers Security
Comprehensive security patterns for protecting Workers and APIs.
Quick Security Checklist
// 1. Validate all input
const validated = schema.parse(await request.json());
// 2. Authenticate requests
const user = await verifyToken(request.headers.get('Authorization'));
if (!user) return new Response('Unauthorized', { status: 401 });
// 3. Rate limit
const limited = await rateLimiter.check(clientIP);
if (!limited.allowed) return new Response('Too Many Requests', { status: 429 });
// 4. Add security headers
response.headers.set('X-Content-Type-Options', 'nosniff');
response.headers.set('X-Frame-Options', 'DENY');
// 5. Use HTTPS-only cookies
headers.set('Set-Cookie', 'session=xxx; Secure; HttpOnly; SameSite=Strict');
Critical Rules
- Never trust client input - Validate and sanitize everything
- Use secure secrets - Store in Wrangler secrets, never in
(truncated - see the full file via the links below)
File tree — 12 files
plugins/cloudflare-workers/skills/cloudflare-workers-security/SKILL.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/authentication.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/cors-security.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/input-validation.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/rate-limiting.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/secrets-management.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/security-headers.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/scripts/security-audit.sh
plugins/cloudflare-workers/skills/cloudflare-workers-security/templates/auth-middleware.ts
plugins/cloudflare-workers/skills/cloudflare-workers-security/templates/cors-handler.ts
plugins/cloudflare-workers/skills/cloudflare-workers-security/templates/rate-limiter.ts
plugins/cloudflare-workers/skills/cloudflare-workers-security/templates/secure-worker.ts
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Secure Cloudflare Workers APIs with authentication and input validation”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Learn the core runtime APIs that power Cloudflare Workers development. This skill covers Fetch for making and handling HTTP requests, Streams for processing large payloads efficiently, Crypto for hashing and signing operations, Cache for response optimization, WebSockets for real-time connections, and text encoding utilities. Includes patterns for timeouts, retries, and error prevention.
Cloudflare Expert provides in-depth knowledge for building serverless applications on Cloudflare's edge platform. Learn to deploy code globally with Workers, optimize caching and CDN performance, implement security features like WAF and DDoS protection, and manage distributed state using Workers KV and Durable Objects.
This skill guides you through creating and deploying Model Context Protocol servers on Cloudflare Workers, complete with custom tools and optional OAuth authentication. Define tools using TypeScript, configure your server entry point, test locally with the MCP Inspector, then deploy to Workers in minutes. Includes patterns for input validation, environment bindings, and connecting clients like Claude Desktop.
Connect to Cloudflare's edge infrastructure to build and deploy serverless applications using Workers, managed databases, object storage, and AI services. Configure KV namespaces, D1 SQLite databases, R2 buckets, and Durable Objects through a unified platform.
This skill guides you through Cloudflare Email Routing for both receiving emails via Workers and sending from verified addresses. Learn to parse incoming messages, implement allowlists and blocklists, route based on content, and handle attachments—all free and production-tested.
This skill covers provisioning and operating Cloudflare R2 buckets via Wrangler CLI, AWS CLI, and boto3, plus binding R2 to Workers for server-side access. Learn lifecycle configuration, presigned URL generation, public bucket serving, and CORS setup to eliminate egress costs for read-heavy workloads and media delivery.
More skills cloudflare-workers-observability (MIT) · Security Engineer (MIT) · better-auth (MIT) · pinme-r2 (MIT) · xss-prevention (MIT) · Typescript Security (GFDL-1.3) · cloudflare-zero-trust-access (MIT)