Skip to content

[SSL/TLS] Fix mTLS debugging Worker example - #32563

Draft
shblue21 wants to merge 1 commit into
cloudflare:productionfrom
shblue21:fix/mtls-debugging-worker-origin
Draft

[SSL/TLS] Fix mTLS debugging Worker example#32563
shblue21 wants to merge 1 commit into
cloudflare:productionfrom
shblue21:fix/mtls-debugging-worker-origin

Conversation

@shblue21

@shblue21 shblue21 commented Aug 6, 2026

Copy link
Copy Markdown

Summary

Updates the mTLS advanced debugging Worker to call fetch(request) after logging request.cf, so requests reach the origin. Adds a warning that global_fetch_strictly_public can route the subrequest back to the same Worker.

Screenshots (optional)

image

Documentation checklist

@cloudflare-docs-bot

cloudflare-docs-bot Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Review

⚠️ 1 warning found in commit 9a2f497.

👉 Fix in your agent 👈
Fix the following review findings in PR #32563 (https://github.com/cloudflare/cloudflare-docs/pull/32563).

Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
  or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.

The comment must come before the commit — the bot reads PR comments when a new
push triggers a review, so skip comments posted after the push will be missed.

---

## Code Review

### Warnings (1)

#### CR-49fb07929271 · Same-zone fetch may recurse to the Worker
- **File:** `src/content/docs/ssl/client-certificates/troubleshooting.mdx` line 82
- **Issue:** The debugging Worker calls `return fetch(request);` on line 82. The worker is attached to the same hostname via a route, so the request URL matches the Worker's own route. With the `global_fetch_strictly_public` compatibility flag enabled, Cloudflare routes the subrequest back through the "front door," which can re-invoke the same Worker and hit the loop limit instead of reaching the origin.
- **Fix:** Avoid relying on same-zone `fetch(request)` to reach the origin. Use an explicit origin target (for example, a service binding to the origin or a rewritten origin URL if the user has origin details), or document that this pattern requires `global_fetch_strictly_public` to be disabled.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

Warnings (1)
File Issue
ssl/client-certificates/troubleshooting.mdx line 82 Same-zone fetch may recurse to the Worker — The debugging Worker calls return fetch(request); on line 82. The worker is attached to the same hostname via a route, so the request URL matches the Worker's own route. With the global_fetch_strictly_public compatibility flag enabled, Cloudflare routes the subrequest back through the "front door," which can re-invoke the same Worker and hit the loop limit instead of reaching the origin. Fix: Avoid relying on same-zone fetch(request) to reach the origin. Use an explicit origin target (for example, a service binding to the origin or a rewritten origin URL if the user has origin details), or document that this pattern requires global_fetch_strictly_public to be disabled.

Conventions

No convention issues found.

Style Guide Review

No style-guide issues found.

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command Description
/review Runs a review now. Incremental if a prior review exists, full if not.
/full-review Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase Rebases the PR branch against production. On conflict, attempts to resolve automatically using AI. Stops with an explanation if confidence is not high enough.

@github-actions github-actions Bot added the size/s label Aug 6, 2026
@shblue21
shblue21 marked this pull request as draft August 6, 2026 04:09
@shblue21
shblue21 force-pushed the fix/mtls-debugging-worker-origin branch 2 times, most recently from 47cbb89 to e771f52 Compare August 6, 2026 06:22
@shblue21
shblue21 force-pushed the fix/mtls-debugging-worker-origin branch from e771f52 to 7397f72 Compare August 6, 2026 06:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

product:ssl Related to SSL size/s

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants