Strip CF-Connecting-IP header from all outbound requests by andyjessop · Pull Request #7914 · cloudflare/workers-sdk

andyjessop · 2025-01-27T09:35:41Z

Strip the CF-Connecting-IP header from outbound requests.

~~This cannot be effectively tested in CI because it interacts badly and in strange ways with bot management and various other protections.~~ To test manually:

Create a hello world worker (or use fixtures/worker-ts)
Add return fetch("https://www.cloudflare.com", request) to the Worker
Run wrangler dev
With this PR, validate that the Cloudflare landing page is returned
Without this PR (pnpx wrangler@latest dev), validate that an error page is returned

Tests
- TODO (before merge)
- Tests included
- Tests not necessary because:
E2E Tests CI Job required? (Use "e2e" label or ask maintainer to run separately)
- I don't know
- Required
- Not required because: covered by unit tests
Public documentation
- TODO (before merge)
- Cloudflare docs PR(s):
- Documentation not necessary because: bugfix
Wrangler V3 Backport
- TODO (before merge)
- Wrangler PR: V3 Backport (fix(wrangler): strip CF-Connecting-IP header from all outbound requests #7914) #8681
- Not necessary because:

changeset-bot · 2025-01-27T09:35:45Z

🦋 Changeset detected

Latest commit: f5675a0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
miniflare	Patch
wrangler	Patch
@cloudflare/pages-shared	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2025-01-27T09:42:43Z

A wrangler prerelease is available for testing. You can install this latest build in your project with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-wrangler-7914

You can reference the automatically updated head of this PR with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/prs/7914/npm-package-wrangler-7914

Or you can use npx with this latest build directly:

npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-wrangler-7914 dev path/to/script.js

Additional artifacts:

cloudflare-workers-bindings-extension:

wget https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-cloudflare-workers-bindings-extension-7914 -O ./cloudflare-workers-bindings-extension.0.0.0-v81ac03b8a.vsix && code --install-extension ./cloudflare-workers-bindings-extension.0.0.0-v81ac03b8a.vsix

create-cloudflare:

npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-create-cloudflare-7914 --no-auto-update

@cloudflare/kv-asset-handler:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-cloudflare-kv-asset-handler-7914

miniflare:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-miniflare-7914

@cloudflare/pages-shared:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-cloudflare-pages-shared-7914

@cloudflare/unenv-preset:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-cloudflare-unenv-preset-7914

@cloudflare/vite-plugin:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-cloudflare-vite-plugin-7914

@cloudflare/vitest-pool-workers:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-cloudflare-vitest-pool-workers-7914

@cloudflare/workers-editor-shared:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-cloudflare-workers-editor-shared-7914

@cloudflare/workers-shared:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-cloudflare-workers-shared-7914

@cloudflare/workflows-shared:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14082081202/npm-package-cloudflare-workflows-shared-7914

Note that these links will no longer work once the GitHub Actions artifact expires.

wrangler@4.4.1 includes the following runtime dependencies:

Package	Constraint	Resolved
`miniflare`	workspace:*	4.20250321.0
`workerd`	1.20250321.0	1.20250321.0
`workerd --version`	1.20250321.0	2025-03-21

Please ensure constraints are pinned, and miniflare/workerd minor versions match.

penalosa · 2025-01-27T13:12:25Z

packages/wrangler/src/__tests__/api/startDevWorker/utils.test.ts

+			});
+		});
+
+		global.fetch = mockFetch as typeof global.fetch;


This should use MSW if possible

penalosa · 2025-01-27T13:18:27Z

packages/wrangler/src/api/startDevWorker/ProxyController.ts

 			handleRuntimeStdio,
 			liveReload: false,
+
+			outboundService: stripHeader("cf-connecting-ip"),


I'm not sure this is the right place for this. This will strip cf-connecting-ip on outgoing fetches from the Proxy worker, which we don't want to do. I think we should be adding this for local user workers? (LocalRuntimeController)

edmundhung · 2025-03-05T11:44:11Z

packages/wrangler/src/api/startDevWorker/ConfigController.ts

 		bindVectorizeToProd: input.dev?.bindVectorizeToProd ?? false,
 		multiworkerPrimary: input.dev?.multiworkerPrimary,
 		imagesLocalMode: input.dev?.imagesLocalMode ?? false,
+		outboundService: input.dev?.outboundService,


This makes the dev.outboundService options working with startDevWorker

edmundhung · 2025-03-05T11:45:17Z

packages/wrangler/src/dev/miniflare.ts

+					}
+
+					return (
+						config.outboundService?.(request) ??


We will use the user defined outboundService instead of fetch-ing it ourselves if it is available.

edmundhung · 2025-03-05T11:47:25Z

packages/wrangler/src/dev/miniflare.ts

+				outboundService(request) {
+					if (request.headers.has("CF-Connecting-IP")) {
+						request.headers.delete("CF-Connecting-IP");
+					}


This outboundService applies to the User Worker only. We were trying to add it to all workers in the LocalRuntimeController which might includes wrapped bindings and crash because it does not support outboundService.

emily-shen · 2025-03-06T14:40:25Z

should we be doing this in miniflare?

edmundhung · 2025-03-06T15:53:39Z

should we be doing this in miniflare?

Good point. I didn't notice this was done on the miniflare side. I will give it another look to see if we can strip it there.

LukePammant · 2025-03-18T19:11:59Z

Hey there, curious if there are any plans to get this in the next version of wrangler. I'm unable to locally test on any of my customers sites (#8333). Or is there any quick work around I can add to my code to get around this limitation in the meantime?

third774 · 2025-03-18T19:59:42Z

@LukePammant one (less than ideal) workaround I've discovered that may or may not work for you is that you can use remote mode instead of local: wrangler dev --remote

penalosa · 2025-05-02T15:24:43Z

I've pushed a new commit that implements this in Miniflare. There's a test for the positive case, but it's hard to test the negative case in CI because it interacts badly with bot detection. To test manually, try making a fetch request to dash.cloudflare.com from within a Worker. With this change it should succeed, but without this change it should fail.

petebacondarwin · 2025-05-02T16:10:51Z

packages/miniflare/test/index.spec.ts

+	const landingPage = await mf.dispatchFetch("http://example.com/");
+	t.assert(
+		!(await landingPage.text()).includes(
+			"Unfortunately, it is resolving to an IP address that is creating a conflict within Cloudflare's system"


This feels a bit fragile... if the backend slightly changed this error message this assertion would always pass.

packages/wrangler/src/api/startDevWorker/ProxyController.ts

github-actions · 2025-05-07T14:43:30Z

Failed to automatically backport this PR's changes to Wrangler v3. Please manually create a PR targeting the v3-maintenance branch with your changes. Thank you for helping us keep Wrangler v3 supported!

Depending on your changes, running git rebase --onto v3-maintenance main aj/strip-cf-connecting-ip-header might be a good starting point.

github-actions · 2025-05-07T14:45:56Z

A Wrangler prerelease is available for testing. You can install this latest build in your project with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-wrangler-7914

Prereleases for other packages:

cloudflare-workers-bindings-extension:

wget https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-cloudflare-workers-bindings-extension-7914 -O ./cloudflare-workers-bindings-extension.0.0.0-v262c37821.vsix && code --install-extension ./cloudflare-workers-bindings-extension.0.0.0-v262c37821.vsix

create-cloudflare:

npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-create-cloudflare-7914 --no-auto-update

@cloudflare/kv-asset-handler:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-cloudflare-kv-asset-handler-7914

miniflare:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-miniflare-7914

@cloudflare/pages-shared:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-cloudflare-pages-shared-7914

@cloudflare/unenv-preset:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-cloudflare-unenv-preset-7914

@cloudflare/vite-plugin:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-cloudflare-vite-plugin-7914

@cloudflare/vitest-pool-workers:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-cloudflare-vitest-pool-workers-7914

@cloudflare/workers-editor-shared:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-cloudflare-workers-editor-shared-7914

@cloudflare/workers-shared:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-cloudflare-workers-shared-7914

@cloudflare/workflows-shared:

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/14970437289/npm-package-cloudflare-workflows-shared-7914

Note that these links will no longer work once the GitHub Actions artifact expires.

stale

packages/miniflare/test/index.spec.ts

petebacondarwin · 2025-05-07T20:12:52Z

packages/miniflare/test/index.spec.ts

+	// The CF-Connecting-IP header value of "fake-value" should be stripped by Miniflare, and should be replaced with a generic 127.0.0.1
+	t.notDeepEqual(await landingPage.text(), "fake-value");
+});
+test("Miniflare: does not strip CF-Connecting-IP when configured", async (t) => {


Can we add an empty line here?

…tbound requests #7914) (#8681) * Strip CF-Connecting-IP * Create cyan-years-relate.md * Address comments * remove test * re-add test * fix tests * fix miniflare.ts * fix compat date --------- Co-authored-by: Samuel Macleod <smacleod@cloudflare.com>

andyjessop force-pushed the aj/strip-cf-connecting-ip-header branch from 0adafea to 63500ea Compare January 27, 2025 10:34

andyjessop marked this pull request as ready for review January 27, 2025 10:34

andyjessop requested a review from a team as a code owner January 27, 2025 10:34

andyjessop added the e2e Run wrangler + vite-plugin e2e tests on a PR label Jan 27, 2025

andyjessop force-pushed the aj/strip-cf-connecting-ip-header branch from 63500ea to d4c3b39 Compare January 27, 2025 10:42

penalosa previously requested changes Jan 27, 2025

View reviewed changes

penalosa force-pushed the aj/strip-cf-connecting-ip-header branch from 28b301a to 60d1e61 Compare February 10, 2025 14:24

edmundhung added the caretaking Priority for caretaking label Mar 3, 2025

edmundhung self-assigned this Mar 3, 2025

edmundhung force-pushed the aj/strip-cf-connecting-ip-header branch from 60d1e61 to 4879bb9 Compare March 4, 2025 16:56

edmundhung changed the title ~~chore: add stripHeader service to Miniflare instance on ProxyController~~ fix(wrangler): strip CF-Connecting-IP header from all outbound requests Mar 4, 2025

edmundhung reviewed Mar 5, 2025

View reviewed changes

petebacondarwin mentioned this pull request Mar 10, 2025

🐛 BUG:Unable to request Shopify sites after version 3.101.0 #8333

Closed

emily-shen force-pushed the aj/strip-cf-connecting-ip-header branch from fca99d2 to 29e8140 Compare March 26, 2025 11:24

workers-devprod mentioned this pull request Mar 26, 2025

V3 Backport (fix(wrangler): strip CF-Connecting-IP header from all outbound requests #7914) #8681

Merged

petebacondarwin mentioned this pull request Apr 25, 2025

🐛 BUG: missing network request header causes IP address conflict when hitting Cloudflare-proxied domain in #7924

Closed

Strip CF-Connecting-IP

cada740

penalosa force-pushed the aj/strip-cf-connecting-ip-header branch from 29e8140 to cada740 Compare May 2, 2025 15:23

penalosa assigned penalosa and unassigned edmundhung May 2, 2025

Create cyan-years-relate.md

1d8226d

penalosa changed the title ~~fix(wrangler): strip CF-Connecting-IP header from all outbound requests~~ Strip CF-Connecting-IP header from all outbound requests May 2, 2025

petebacondarwin reviewed May 2, 2025

View reviewed changes

penalosa requested a review from petebacondarwin May 7, 2025 14:41

Address comments

ce6d6d3

penalosa force-pushed the aj/strip-cf-connecting-ip-header branch from fb431dc to ce6d6d3 Compare May 7, 2025 14:42

penalosa added 4 commits May 7, 2025 16:23

remove test

cb3173b

re-add test

6fd29f4

fix tests

8929428

fix miniflare.ts

1ce20c7

fix compat date

f6fb4bf

penalosa added the skip-v3-pr label May 7, 2025

petebacondarwin approved these changes May 7, 2025

View reviewed changes

github-project-automation bot moved this from In Review to Approved in workers-sdk May 7, 2025

test fixups

f5675a0

penalosa enabled auto-merge May 12, 2025 10:57

penalosa added this pull request to the merge queue May 12, 2025

Merged via the queue into main with commit 37af035 May 12, 2025
18 checks passed

penalosa deleted the aj/strip-cf-connecting-ip-header branch May 12, 2025 11:34

github-project-automation bot moved this from Approved to Done in workers-sdk May 12, 2025

workers-devprod mentioned this pull request May 12, 2025

Version Packages #9175

Merged

penalosa mentioned this pull request May 13, 2025

Regression with TCP connections in 4.15.0 #9238

Closed

Conversation

andyjessop commented Jan 27, 2025 • edited by penalosa Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Jan 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions bot commented Jan 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

emily-shen commented Mar 6, 2025

Uh oh!

edmundhung commented Mar 6, 2025

Uh oh!

LukePammant commented Mar 18, 2025

Uh oh!

third774 commented Mar 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

penalosa commented May 2, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented May 7, 2025

Uh oh!

github-actions bot commented May 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

andyjessop commented Jan 27, 2025 •

edited by penalosa

Loading

changeset-bot bot commented Jan 27, 2025 •

edited

Loading

github-actions bot commented Jan 27, 2025 •

edited

Loading

third774 commented Mar 18, 2025 •

edited

Loading

github-actions bot commented May 7, 2025 •

edited

Loading