cop

cloudflare-origin-pull

Verify that TLS peer certificates came from CloudFlare

Showing:

Popularity

Downloads/wk

1

GitHub Stars

3

Maintenance

Last Commit

4yrs ago

Contributors

2

Package

Dependencies

1

Size (min+gzip)

21.5KB

License

ISC

Type Definitions

Tree-Shakeable

No?

Categories

Readme

cloudflare-origin-pull

CloudFlare has an Authenticated Origin Pulls mode where requests to your origin servers present a CloudFlare issued certificate. This module helps you verify requests to your Node server came from CloudFlare without needing to change how your own SSL certificate is served.

This module has been tested with Node.js 0.10 and above.

You may also be interested in securing access to your origin servers.

Installation

npm install --save cloudflare-origin-pull

Usage

You'll need to run an HTTPS server for this to work. In the example below that's done assuming a certificate in PKCS #12 format named my-cert.p12.

Add the requestCert option and set it to true. This causes your HTTPS server to request the peer certificate from CloudFlare.

Set rejectUnauthorized to false. This allows you to verify the peer certificate yourself.

req.client is a TLSSocket. getPeerCertificate() returns what we hope is CloudFlare's certificate.

The cloudflare-origin-pull module exports a verify() method. Call it with the peer certificate, if any. It verifies whether the certificate was issued by CloudFlare and if it has not yet expired, returning a boolean. verify() does not throw errors and can be called without a certificate (it'll return false).

Simply destroy the client connection if the certificate was not from CloudFlare or no certificate was presented at all.

const https = require('https')
const verify = require('cloudflare-origin-pull').verify

https.createServer({
  pfx: 'my-cert.p12',
  requestCert: true,
  rejectUnauthorized: false
}, (req, res) => {
  if (!verify(req.client.getPeerCertificate())) {
    req.client.destroy()
    return
  }

  res.writeHead(200)
  res.end('You’re cool.')
})

Rate & Review

Great Documentation0
Easy to Use0
Performant0
Highly Customizable0
Bleeding Edge0
Responsive Maintainers0
Poor Documentation0
Hard to Use0
Slow0
Buggy0
Abandoned0
Unwelcoming Community0
100