Skip to content
This repository has been archived by the owner. It is now read-only.
master
Switch branches/tags
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
src
 
 
 
 
 
 
 
 
 
 
 
 
 
 

README.md

cloudflare-origin-pull

CloudFlare has an Authenticated Origin Pulls mode where requests to your origin servers present a CloudFlare issued certificate. This module helps you verify requests to your Node server came from CloudFlare without needing to change how your own SSL certificate is served.

This module has been tested with Node.js 0.10 and above.

You may also be interested in securing access to your origin servers.

Installation

npm install --save cloudflare-origin-pull

Usage

You'll need to run an HTTPS server for this to work. In the example below that's done assuming a certificate in PKCS #12 format named my-cert.p12.

Add the requestCert option and set it to true. This causes your HTTPS server to request the peer certificate from CloudFlare.

Set rejectUnauthorized to false. This allows you to verify the peer certificate yourself.

req.client is a TLSSocket. getPeerCertificate() returns what we hope is CloudFlare's certificate.

The cloudflare-origin-pull module exports a verify() method. Call it with the peer certificate, if any. It verifies whether the certificate was issued by CloudFlare and if it has not yet expired, returning a boolean. verify() does not throw errors and can be called without a certificate (it'll return false).

Simply destroy the client connection if the certificate was not from CloudFlare or no certificate was presented at all.

const https = require('https')
const verify = require('cloudflare-origin-pull').verify

https.createServer({
  pfx: 'my-cert.p12',
  requestCert: true,
  rejectUnauthorized: false
}, (req, res) => {
  if (!verify(req.client.getPeerCertificate())) {
    req.client.destroy()
    return
  }

  res.writeHead(200)
  res.end('You’re cool.')
})

About

Verify that TLS peer certificates came from CloudFlare

Resources

License

Packages

No packages published