cloudflare-workers-security
Cloudflare Workers Security delivers production patterns for protecting APIs and Workers through authentication verification, request rate limiting, input validation, and security headers. It covers JWT and API key validation, CORS configuration, and defends against common vulnerabilities like injection, XSS, and unauthorized access.
Cloudflare Workers Security provides authentication, rate limiting, and input validation patterns to protect your APIs.
AI-generated summary based on this skill's SKILL.md
Install
secondsky/claude-skills/cloudflare-workers-security · repository language: TypeScript
git clone https://github.com/secondsky/claude-skills
cp -r claude-skills/plugins/cloudflare-workers/skills/cloudflare-workers-security ~/.claude/skills/cloudflare-workers-securitynpx skillfed install secondsky/claude-skills/cloudflare-workers-securityFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are the security best practices for Cloudflare Workers?
Cloudflare Workers Security recommends a layered approach: implement authentication (JWT or API keys) at entry points, validate all inputs rigorously, set restrictive security headers, enable rate limiting to prevent DoS, and use environment variables for secrets. The skill covers production patterns for each layer, from middleware setup to vulnerability prevention, ensuring your Workers APIs resist common attacks like injection, XSS, and unauthorized access.
How do I add authentication to Cloudflare Workers?
Cloudflare Workers Security provides patterns for JWT verification and API key validation as middleware. Extract tokens from Authorization headers, verify signatures against your key material, and reject invalid requests early. The skill includes examples for both JWT and API key approaches, allowing you to choose based on your architecture. Secrets should be stored in environment variables, never hardcoded.
How can I fix CORS errors in Cloudflare Workers?
Cloudflare Workers Security covers safe CORS configuration by setting appropriate Access-Control headers in responses. Define allowed origins explicitly (avoid wildcards in production), specify permitted methods and headers, and handle preflight OPTIONS requests. The skill shows how to validate origin headers and configure credentials safely, preventing both access errors and security gaps from overly permissive policies.
What rate limiting and DoS protection does Cloudflare Workers offer?
Cloudflare Workers Security implements rate limiting through request counting and sliding windows, rejecting excess traffic with 429 responses. Combine this with security headers and input validation to defend against DoS. The skill provides patterns for per-IP or per-user limits, durable objects for state, and integration with Cloudflare's edge protections to create defense-in-depth against volumetric and application-layer attacks.
How do I prevent XSS and injection attacks in Cloudflare Workers?
Cloudflare Workers Security emphasizes input validation—sanitize and type-check all request data before use. Set Content-Security-Policy and X-Content-Type-Options headers to limit XSS impact. For database queries, use parameterized statements. The skill covers validation patterns, header configuration, and common injection vectors (SQL, command, template), helping you block malicious payloads at the Worker boundary before they reach downstream systems.
How should I manage API keys and secrets securely in Workers?
Cloudflare Workers Security stores secrets in environment variables and Durable Objects, never in code or logs. Rotate keys regularly, use short expiration windows, and audit access. The skill shows how to load secrets at runtime, validate API keys against a store, and implement key versioning. Combine with rate limiting per key and monitoring to detect compromised credentials early.
SKILL.md
rendered from the published skill — quoted content, verbatim
Cloudflare Workers Security
Comprehensive security patterns for protecting Workers and APIs.
Quick Security Checklist
// 1. Validate all input
const validated = schema.parse(await request.json());
// 2. Authenticate requests
const user = await verifyToken(request.headers.get('Authorization'));
if (!user) return new Response('Unauthorized', { status: 401 });
// 3. Rate limit
const limited = await rateLimiter.check(clientIP);
if (!limited.allowed) return new Response('Too Many Requests', { status: 429 });
// 4. Add security headers
response.headers.set('X-Content-Type-Options', 'nosniff');
response.headers.set('X-Frame-Options', 'DENY');
// 5. Use HTTPS-only cookies
headers.set('Set-Cookie', 'session=xxx; Secure; HttpOnly; SameSite=Strict');
Critical Rules
- Never trust client input - Validate and sanitize everything
- Use secure secrets - Store in Wrangler secrets, never in
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 12 files
plugins/cloudflare-workers/skills/cloudflare-workers-security/SKILL.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/authentication.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/cors-security.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/input-validation.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/rate-limiting.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/secrets-management.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/references/security-headers.md
plugins/cloudflare-workers/skills/cloudflare-workers-security/scripts/security-audit.sh
plugins/cloudflare-workers/skills/cloudflare-workers-security/templates/auth-middleware.ts
plugins/cloudflare-workers/skills/cloudflare-workers-security/templates/cors-handler.ts
plugins/cloudflare-workers/skills/cloudflare-workers-security/templates/rate-limiter.ts
plugins/cloudflare-workers/skills/cloudflare-workers-security/templates/secure-worker.ts