It would need to be done on L7 as the only way to identify a Worker uniquely is the CF-Worker request header