Restrict outgoing worker traffic with whitelist
Hello,
Is it possible to restrict outgoing worker traffic ? Something like a firewall after the worker
I'd like to block all requests (http fetch, websocket..) except those made to specific authorized domains which i whitelisted earlier (on the cloudflare dashboard for example). The idea is to prevent any lib added to my worker from making request I'm not aware of and therefore prevent any potential data leak in the future.
thanks !
2 Replies
Hey, today you can only achieve this with "Outbound workers" on Workers for Platforms. Technically, you could deploy all your workers to a WfP namespace, and add an outbound worker. I believe most Workers features are supported now, so the only drawback (besides the cost) is the added complexity
Hey, thanks for your answer 🙂
yes, I was aware of the workers for platform solution but, correct me if I'm wrong, even if the outgoing worker can precisely take the role of a firewall to monitor all requests from child workers and block them if necessary, there is nothing that can prevent a request to be made if intiated from the platform worker thread ?
Many developers (including me) do not take enough time to analyze all the libraries they install (and their dependencies), and even if they do so, they would have to review them on every update because something malicious may have been inserted in the code.
I may sound like a little bit paranoid, but there are more and more stories of malicious code designed like this to steal data as they can do a lot more things... and faster.
A "firewall" (a basic whitelist of trusted domains) could be a very simple solution to fix this, don't you think ?
* it is very easy to patch any method and add a proxy function to execute some code before and/or after calls made by the worker, while still remaining totally invisible. An simple "import" in one dependency is enough to open the door. With the help of libs like 'ride' (github.com/dtinth/ride) it only requires a few lines of code to implement a listener that can observe all http calls for example, looking for credentials before they even leave the worker. With a firewall the malicious code will not be able to upload the collected data.