Article
Building a Better Cloudflare Gateway Block Page
How I used a Cloudflare Worker to enrich Gateway blocks with policy, device, user, category and Cloudflare One Client context while keeping the page resilient and secure.
Topic
Workers
14 matching entries across Articles, TIL and Projects.
Articles
Long-form writing tagged Workers.
Article
Gating Cloudflare Access on Training Completion
Authentication proves identity, but it does not prove a user has met a business requirement. I used Cloudflare Access External Evaluation, Workers and D1 to add training compliance to the access decision.
Article
Making Cloudflare Access Denials Actually Useful
A custom Cloudflare Access denial page can turn a generic block into useful identity, device, posture and network diagnostics without exposing sensitive control-plane details.
Article
Zero Trust Allow Lists with Workers KV
A small Cloudflare Worker can provide a controlled front end for Gateway allow-list changes while KV supplies recovery, synchronization and operational visibility.
Today I Learned
Short notes and fixes tagged Workers.
Today I learned
Cloudflare Access Checks Must Fail Closed
For a training-compliance Access evaluator, I treat missing users, invalid requests and database errors as deny conditions instead of accidental allows.
Today I learned
Bounded Retries for Cloudflare API Calls
Short-lived Cloudflare API failures can justify a retry, but diagnostic Workers still need a bounded attempt count and a useful fallback value.
Today I learned
Resolve Gateway Rule IDs Before Showing Them
Cloudflare Gateway can provide a rule ID to a custom block page, but resolving that UUID to the rule name makes support diagnostics much more useful.
Today I learned
CSP Nonces in Cloudflare Workers
For dynamically generated security pages, I use a per-response nonce so required inline script/style can run without falling back to a broad unsafe-inline CSP.
Today I learned
Gateway Block Pages Need Policy Context
A CF-Ray header alone does not prove a request came from Gateway, so my Worker requires Gateway-specific query context before rendering diagnostic output.
Today I learned
Workers KV Is Backup, Not Source of Truth
In my Gateway allow-list Worker, Cloudflare lists remain the enforcement state while Workers KV stores backup and synchronization metadata.
Projects
Projects and implementation patterns tagged Workers.
ProjectActive
Cloudflare Access Denied Information Page
A Cloudflare Worker that turns an Access denial into a support-friendly diagnostic page with identity, device, posture, WARP, network and recent-access context.
ProjectActive
Cloudflare Allowed Domain Handler
A Cloudflare Worker that provides a narrow, Access-protected workflow for validated Gateway allow-list changes with DNS/HTTP targeting and Workers KV backup.
ProjectActive
Cloudflare Gateway Custom Block Page
A Cloudflare Worker that enriches Gateway blocks with rule names, request category, user, device, Cloudflare One Client addresses and support correlation data.
ProjectActive
Cloudflare Training Compliance Gateway
An Access External Evaluation Worker that uses D1-backed training state to require mandatory training completion before protected applications can be opened.