The forwarding Worker

A few lines. The full context.

Gateway invokes GatewayMiddleware.handle(request, context, next) before the request reaches its destination.

src/forward.jsDeployed source · JavaScript

1import { WorkerEntrypoint } from "cloudflare:workers";
2import { captureContext } from "./capture.js";
3import { CAPTURE_HEADER, DEMO_EMAIL, DEMO_HOST } from "./config.js";
4
5export class GatewayMiddleware extends WorkerEntrypoint {
6  async handle(request, context, next) {
7    const headers = new Headers(request.headers);
8    headers.delete(CAPTURE_HEADER);
9    const url = new URL(request.url);
10
11    if (url.hostname === DEMO_HOST && request.method === "GET" &&
12        (url.pathname === "/" || url.pathname === "/context")) {
13      // Gateway supplies the context, including lazy identity and posture.
14      const snapshot = await captureContext(request, context);
15
16      if (snapshot.identity.value?.email === DEMO_EMAIL) {
17        // Save privately before continuing the original request to the site.
18        const ticket = await this.env.CONTEXT_VIEWER.capture(snapshot);
19        headers.set(CAPTURE_HEADER, ticket);
20      }
21    }
22
23    // Continue to the original destination using Gateway routing and egress.
24    return next(new Request(request, { headers }));
25  }
26}
27
28export default {
29  fetch() {
30    return new Response("Gateway RPC entrypoint only.", { status: 403 });
31  },
32};

01 / Receive

Read the original request metadata and resolve identity and device posture.

02 / Save

Save this user's capture privately and attach a signed, single-use reference.

03 / Continue

Call next(request) once. Gateway sends the request to its original destination.

Context capture helper src/capture.js

1import { CAPTURE_HEADER, CONTEXT_FIELDS } from "./config.js";
2
3const SECRET_KEY = /(?:authorization|cookie|password|passwd|secret|token|api[-_]?key|credential|assertion|jwt)/i;
4const SAFE_HEADER = /^(?:accept|accept-encoding|accept-language|cache-control|content-length|content-type|host|origin|sec-ch-ua(?:-mobile|-platform)?|sec-fetch-(?:dest|mode|site|user)|upgrade-insecure-requests|user-agent|cf-ray|cf-connecting-ip|x-forwarded-proto)$/i;
5
6export function safeUrl(value) {
7  try {
8    const url = new URL(value);
9    url.username = "";
10    url.password = "";
11    url.hash = "";
12    for (const key of [...url.searchParams.keys()]) {
13      if (SECRET_KEY.test(key) || /^(?:code|state|session|sig|signature)$/i.test(key)) {
14        url.searchParams.set(key, "[redacted]");
15      }
16    }
17    return url.href;
18  } catch {
19    return "[invalid URL]";
20  }
21}
22
23export function safeValue(value, key = "", ancestors = new Set()) {
24  if (SECRET_KEY.test(key)) return "[redacted]";
25  if (typeof value === "function" || value === undefined || typeof value === "symbol") return undefined;
26  if (typeof value === "string") {
27    return /^https?:\/\//i.test(value) ? safeUrl(value) : value;
28  }
29  if (typeof value === "bigint") return String(value);
30  if (value === null || typeof value !== "object") return value;
31  if (ancestors.has(value)) return "[circular reference]";
32  const nextAncestors = new Set(ancestors).add(value);
33  if (Array.isArray(value)) return value.map((item) => safeValue(item, "", nextAncestors));
34  return Object.fromEntries(Object.entries(value)
35    .filter(([, item]) => typeof item !== "function" && item !== undefined)
36    .map(([name, item]) => [name, safeValue(item, name, nextAncestors)]));
37}
38
39async function resolveContext(context, method) {
40  if (typeof context?.[method] !== "function") return { status: "unavailable" };
41  try {
42    const value = await context[method]();
43    return value === undefined
44      ? { status: "not provided" }
45      : { status: "available", value: safeValue(value) };
46  } catch {
47    return { status: "unavailable" };
48  }
49}
50
51export async function captureContext(request, context) {
52  const [identity, devicePosture] = await Promise.all([
53    resolveContext(context, "identity"),
54    resolveContext(context, "devicePosture"),
55  ]);
56  const metadata = {};
57  for (const field of new Set([...Object.keys(context ?? {}), ...CONTEXT_FIELDS])) {
58    if (field === "identity" || field === "devicePosture") continue;
59    const value = safeValue(context?.[field], field);
60    if (value !== undefined) Object.defineProperty(metadata, field, { value, enumerable: true });
61  }
62  return {
63    capturedAt: new Date().toISOString(),
64    context: metadata,
65    identity,
66    devicePosture,
67    request: {
68      method: request.method,
69      url: safeUrl(request.url),
70      headers: Object.fromEntries([...request.headers]
71        .filter(([name]) => name !== CAPTURE_HEADER)
72        .map(([name, value]) => [name, SAFE_HEADER.test(name) ? value : "[not captured]"])),
73      ...(request.cf ? { cf: safeValue(request.cf) } : {}),
74    },
75  };
76}

Demo configuration src/config.js

1export const DEMO_HOST = "context.grstnhbr.com";
2export const DEMO_EMAIL = "albertjason.g@gmail.com";
3export const CAPTURE_HEADER = "x-connect-context-capture";
4export const CAPTURE_TTL_MS = 15 * 60 * 1000;
5export const CONTEXT_FIELDS = [
6  "srcIp", "srcPort", "dstIp", "dstPort", "protocol", "detectedProtocol",
7  "sni", "onrampType", "vnetId", "proxyEndpoint", "internalSrcIp", "accountTag",
8  "policyId", "privateAppAud", "infraAppAuds", "host", "uri",
9  "embeddedProtocols", "domainCategories",
10];