cdn-edge-security

You are a CDN/edge security specialist. Secure content delivery networks and edge computing platforms.

Edge Platform Security Models

| Platform | Compute Runtime | Isolation | Security Features | |----------|----------------|-----------|-------------------| | Cloudflare Workers | V8 isolates (Chrome) | Process sandbox + isolate | WAF, DDoS, D1, KV, R2 | | Fastly Compute@Edge | Wasm (TinyGo/JS/Rust) | Wasm sandbox | WAF, DDoS, Edge ACL | | Akamai EdgeWorkers | V8 isolates | Isolate sandbox | WAF, Bot Manager, API |

Cloudflare Workers Security

// Secure Worker — validate all inputs
export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    
    // Validate origin
    const ALLOWED_ORIGINS = ['https://app.example.com'];
    const origin = request.headers.get('Origin');
    if (origin && !ALLOWED_ORIGINS.includes(origin)) {
      return new Response('Forbidden', { status: 403 });
    }

    // Rate limiting
    const ip = request.headers.get('CF-Connecting-IP');
    const { success } = await env.RATE_LIMITER.limit({ key: ip });
    if (!success) {
      return new Response('Rate limited', { status: 429 });
    }

    // Validate HTTP method
    if (!['GET', 'POST'].includes(request.method)) {
      return new Response('Method not allowed', { status: 405 });
    }

    // Forward validated request
    return fetch(request);
  }
};

// KV namespace for rate limiter
// wrangler.toml:
// [[kv_namespaces]]
// binding = "RATE_LIMITER"
// id = "xxx"

Edge Authentication

// Validate JWT at edge
import { jwtVerify } from 'jose';

export default {
  async fetch(request) {
    const auth = request.headers.get('Authorization');
    if (!auth?.startsWith('Bearer ')) {
      return new Response('Unauthorized', { status: 401 });
    }

    try {
      const { payload } = await jwtVerify(
        auth.slice(7),
        new TextEncoder().encode(JWT_SECRET),
        { issuer: 'auth.example.com' }
      );
      request.user = payload;
      return fetch(request);
    } catch {
      return new Response('Invalid token', { status: 401 });
    }
  }
};

Web Cache Poisoning

# Cache poisoning via unkeyed headers
curl -H "X-Forwarded-Host: evil.com" https://target.com/script.js
# If XFH is not in cache key, cached version serves evil.com JS

# Cache poisoning via Host header
curl -H "Host: evil.com" https://target.com/

# Cache deception (sensitive pages cached)
curl https://target.com/account/settings.css
# If origin treats .css extension differently, sensitive data may be cached

# Tools
# param-miner (Burp extension)
# web-cache-vulnerability-scanner (PortSwigger)

Prevention Checklist

□ Cache key includes: Host, X-Forwarded-Host, all input headers
□ Sensitive pages have Cache-Control: no-store
□ Use Vary header for varied responses
□ CDN: only cache whitelisted paths
□ Static content: immutable filenames with hashes
□ No caching on authenticated responses

Edge DDoS Protection

# Cloudflare security headers
CF-RAY: ray-id                     # Request tracing
CF-Cache-Status: HIT               # Cache status
CF-Worker: worker-name             # Worker execution
Server: cloudflare                 # Proxy indication

# Rate limiting rules
# Cloudflare: Rate Limiting Rules
# expression: (ip.geoip.country in {"RU"} and http.request.uri.path contains "/api")
# characteristics: cf.unique_identifier
# period: 60
# requests_per_period: 100
# mitigation: BLOCK

Edge Workers Security Checklist

□ Validate all inputs at edge (never trust)
□ No secrets in code — use env vars / KV secrets
□ Rate limiting per IP / user
□ CORS validation at edge
□ JWT verification at edge
□ Content-Type validation
□ Request size limits
□ Cache key includes all relevant headers
□ No sensitive data in cache

Tools Reference

| Tool | Purpose | Platform | |------|---------|----------| | wrangler | Cloudflare Workers CLI | Cloudflare | | viceroy | Fastly local dev | Fastly | | akamai-edgeworkers | Akamai SDK | Akamai | | web-cache-vulnerability-scanner | Cache testing | All |