Support for Cloudflare Workers

[davidmytton]

Allow us to support applications built on Cloudflare workers. There's a lot of useful data in the request context cf property we could make use of.

[blaine-arcjet]

This is blocked by Connect RPC's requirement to construct a client with a baseUrl. We want to avoid reconstructing a client on each request to the worker.

[blaine-arcjet]

Related: Connect doesn't work well on Cloudflare, see connectrpc/connect-es#577

[blaine-arcjet]

Someone suggested dynamic baseUrl in connectrpc/connect-es#678 but it was closed as wontfix.

[davidmytton]

I spent a bit of time researching where we're at with support for Cloudflare workers.

This is blocked by Connect RPC's requirement to construct a client with a baseUrl. We want to avoid reconstructing a client on each request to the worker.

Seems there's a few reasons for this:

1. We want to load our WASM module into the worker outside of the request context so it can be instantiated once rather than on every request. This is why we recommend creating the Arcjet client outside of the request handler for our other adapters.
2. With feat: Attempt to warm http2 connection upon SDK startup #1201 we'd like to have a persistent connection to improve latency across requests.
3. The DX is better when you can define base rules in a client and then withRule any additional rules you might want to combine.

With Cloudflare's move from Service Workers to ES Modules, environment variables are no longer provided in the global scope. Instead, they're passed as a binding to the handler. Trying to access them as a global will error.

Also, creating the connect client requires a base URL, which we configure dynamically based on the environment variables.

Loading WASM

Cloudflare officially supports WASM in workers. They have some history with slow worker startup, but it seems they've implemented a fix for this. From 2020:

We found a way to enable V8’s Liftoff+Tier-up that we like. This should go out to production next week. I think it should cut Wasm startup time by a factor of 5-10. (This still doesn’t use code cache, which is a much bigger project that should cut Wasm startup time to almost nothing. No timeline on that yet, but let’s see how much Liftoff helps.)

It would be interesting to test the startup time of our WASM Module. They must be instantiated in the global scope outside of the handler, which implies some optimization may be going on.

There is also a worker size limit of 1MB for free plans, 10MB for paid plans.

Persistent connections

Cloudflare doesn't support persistent outbound connections so we don't get any benefit here.

You can see in the examples for databases, they create a new connection within the workers handler, then it closes after the request ends.

Given this, we could avoid our usage of the dynamic baseUrl and use a static URL when in the workers environment.

I assume we'd use the fetch client from Connect: connectrpc/connect-es#577 (comment)

Did I miss anything or get anything wrong?

[prometixX]

is there any update for the cloudflare worker support?

[davidmytton]

Hi @prometixX - no updates I'm afraid. We've prioritized other product areas so don't have an ETA.

[wooorm-arcjet]

Did some digging into this, and at least got it to work.

• do step 1 through 3 from https://developers.cloudflare.com/workers/get-started/guide/
• "type": "module", in package.json for ESM
• run npx wrangler types for types
• add some tsconfig to check things (example at the bottom)
• add a .env with an ARCJET_KEY=XXX
• install @arcjet/headers, @arcjet/ip, @arcjet/protocol, @arcjet/transport, arcjet
• apply the patches from feat(stable-hash, transport): support workerd #5077 locally in node_modules (just look for the package.json changes, and point them to the edge-runtime files)
• then, in src/index.js:

import {ArcjetHeaders} from '@arcjet/headers'
import {findIp} from '@arcjet/ip'
import {createClient} from '@arcjet/protocol/client.js'
import {createTransport} from '@arcjet/transport'
import arcjet, {detectBot} from 'arcjet'

const baseUrl = 'https://decide.arcjet.com'

const client = createClient({
  baseUrl,
  sdkStack: 'FASTIFY', // A small lie.
  sdkVersion: '1.0.0-beta.11',
  timeout: 500,
  transport: createTransport(baseUrl),
})

export default {
  /**
   * @param {Request} request
   * @param {Record<string, string>} env
   * @param {ExecutionContext} ctx
   * @returns {Promise<Response>}
   */
  async fetch(request, env, ctx) {
    const now = Date.now()
    const key = env.ARCJET_KEY

    if (!key) throw new Error('Missing ARCJET_KEY environment variable')

    const aj = arcjet({
      client,
      key,
      log: console,
      rules: [detectBot({deny: ['CURL'], mode: 'LIVE'})]
    })

    const url = new URL(request.url)
    const decision = await aj.protect(
      {async getBody() { return undefined }, waitUntil: ctx.waitUntil.bind(ctx)},
      {
        cookies: request.headers.get('cookie') || '',
        host: url.host,
        headers: new ArcjetHeaders(request.headers),
        ip: findIp(request, {platform: 'cloudflare'}) || '127.0.0.1',
        method: request.method,
        path: url.pathname,
        protocol: url.protocol,
        query: url.search,
      }
    )

    console.log(request)
    console.log('Request finished with ' + decision.conclusion + ' in ' + (Date.now() - now) + 'ms')

    // `curl http://localhost:8787 -H "User-Agent: curl/7.79.1"` results in Access denied.
    // (My curl is configured locally to use a different header, hence explicit.)
    // Visiting in a browser results in a successful response.
    return decision.conclusion === 'DENY'
      ? new Response('Access denied', {status: 403})
      : new Response('Hello World!')
  },
};

Running all that with npx wrangler dev, gives denies and allows.
Response times are about 5ms for a deny (as that happens locally) and 50ms for an allow (as that contacts the decide api).

example tsconfig.json

{
  "compilerOptions": {
    "checkJs": true,
    "customConditions": ["development"],
    "declarationMap": true,
    "declaration": true,
    "emitDeclarationOnly": true,
    "exactOptionalPropertyTypes": true,
    "lib": ["es2022"],
    "module": "node16",
    "strict": true,
    "target": "es2022"
  },
  "exclude": ["node_modules/"],
  "include": ["**/*.js", "worker-configuration.d.ts"]
}