Cloudflare Zero Trust and Authentication

Comics Now! is designed to run securely behind Cloudflare Zero Trust (Access). This eliminates the need to expose open ports or manage public passwords.

How Cloudflare Access Works

When a user visits your domain, Cloudflare Access validates their identity (via Google, GitHub, SAML, or one-time pin) and issues a signed JSON Web Token (JWT) in the request header:

Cf-Access-Jwt-Assertion: <signed-jwt-token>

The Comics Now! origin server validates:

1. Algorithm Pinning: Strictly verifies RS256 signatures to prevent algorithm confusion attacks.
2. JWKS Key Caching & Rate-Limiting: Retrieves public keys from https://<CLOUDFLARE_TEAM_DOMAIN>/cdn-cgi/access/certs with a 1-hour in-memory cache and a rate limit of 10 requests/minute.
3. Audience Verification: Validates that the JWT was generated specifically for your application AUD tag (CLOUDFLARE_AUD).
4. User Creation: Automatically provisions the user in the SQLite database based on their Cloudflare email.

Configuring Environment Variables

Add these to your .env or Docker environment:

CLOUDFLARE_TEAM_DOMAIN=myteam.cloudflareaccess.com
CLOUDFLARE_AUD=a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890

Trusted LAN & Local Auto-Admin

To make administration seamless on your home network, Comics Now! includes socket-level private network auto-elevation:

• When accessed from a private LAN IP (e.g. 127.0.0.1, ::1, 192.168.x.x, 10.x.x.x, 172.16-31.x.x), the server inspects req.socket.remoteAddress directly.
• LAN connections automatically authenticate as the primary admin user (default-user).
• Security Guard: External attackers attempting to spoof X-Forwarded-For from the internet cannot trigger LAN elevation because Comics Now! validates the physical network socket.