Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Workers: Run JavaScript Service Workers at the Edge

blog.cloudflare.com

Post reply on HN
Print view View original

1–10 of 134 posts

Re: Cloudflare Workers: Run JavaScript Service Workers at the Edge

#3

Post by jayrox »

kentonv wrote: post #2

Hey all! This is my project at Cloudflare. (You may remember me as the tech lead of Sandstorm.io and Cap'n Proto.) Happy to answer questions!

This is really interesting. I have an idea where this could be helpful to the Plex user community. Recently Plex added a header that blocks the page from being iframed (X-Frame-Options).

Would doing something like this, obviously replacing example.com with their own domain.com, replace the offending header?

  addEventListener('fetch', event => {  
    let request = event.request;
    if (request.headers.has('X-Frame-Options')) {
      let newHeaders = new Headers(request.headers);
      newHeaders.set('X-Frame-Options', 'ALLOW-FROM https://example.com/');
      event.respondWith(fetch(request, {headers: newHeaders}));
    }
  
    // Use default behavior.
    return;
  });

Re: Cloudflare Workers: Run JavaScript Service Workers at the Edge

#4

Post by kentonv »

jayrox wrote: post #3
kentonv wrote: post #2

Hey all! This is my project at Cloudflare. (You may remember me as the tech lead of Sandstorm.io and Cap'n Proto.) Happy to answer questions!

This is really interesting. I have an idea where this could be helpful to the Plex user community. Recently Plex added a header that blocks the page from being iframed (X-Frame-Options). Would doing something like this, obviously replacing example.com with their own domain.com, replace the offending header? addEventListener('fetch', event => { let request = event.request; if (request.headers.has('X-Frame-Options')) {…

Yes.

Of course, you could only apply it to your own server.

Also, you would want to think carefully about clickjacking attacks (where someone puts your site in an invisible iframe and tricks people into clicking on it). The X-Frame-Options header was probably added to prevent clickjacking.

Re: Cloudflare Workers: Run JavaScript Service Workers at the Edge

#5

Post by jayrox »

kentonv wrote: post #4
jayrox wrote: post #3

Earlier quoted context omitted.

This is really interesting. I have an idea where this could be helpful to the Plex user community. Recently Plex added a header that blocks the page from being iframed (X-Frame-Options). Would doing something like this, obviously replacing example.com with their own domain.com, replace the offending header? addEventListener('fetch', event => { let request = event.request; if (request.headers.has('X-Frame-Options')) {…

Yes. Of course, you could only apply it to your own server. Also, you would want to think carefully about clickjacking attacks (where someone puts your site in an invisible iframe and tricks people into clicking on it). The X-Frame-Options header was probably added to prevent clickjacking.

Of course this would be the user's personally hosted server. Typically hidden behind a password and loaded in some sort of HTPC manager like Organizr.

According to reports, Plex' intention was to prevent clickjacking, which is perfectly reasonable but left many of their users from being able to use their Plex servers within the HTPC managers.

Re: Cloudflare Workers: Run JavaScript Service Workers at the Edge

#10

Post by kentonv »

Gys wrote: post #7

So in a way this is similar to for example AWS Lambda ? It can process incoming http requests in many ways ? Fascinating idea. Is there any indication on price level ? And what about runtime duration ?

It's actually somewhat different. AWS Lambda is intended to act as your origin server. Generally your Lambda functions run in a small number of locations, not necessarily close to users.

Cloudflare Workers will run in all of Cloudflare's 117 (and growing) locations. The idea is that you'd put code in a worker if you need the code to run close to the user. You might want that to improve page load speed, or to reduce bandwidth costs (don't have to pay for the long haul), or because you want to augment Cloudflare's feature set, or a number of other reasons. But, generally, you would not host your whole service on this. (Well, you could, but it's not the intent.)

We haven't nailed down pricing yet, but we've worked hard to create the most efficient possible design so that we can make pricing attractive.

Post reply on HN