#cloudflare

How we found a bug in the hyper HTTP library

Nhóm Cloudflare Images phát hiện lỗi điều kiện chạy (race condition) trong thư viện hyper HTTP (phiên bản 0.14–1.8) khi chuyển đổi sang sử dụng Unix sockets, khiến dữ liệu ảnh lớn bị cắt xén ngẫu nhiên do vòng lặp xử lý không chờ Poll::Pending từ poll_flush. Lỗi chỉ xuất hiện trong môi trường sản xuất với tải cao, không thể tái hiện bằng curl hay thử nghiệm cục bộ. Nhóm đã khắc phục bằng cách bổ sung 4 dòng lệnh vào poll_shutdown để đảm bảo dữ liệu được ghi hết trước khi đóng kết nối.

Lập trình viên cần đọc bài này để hiểu cách một lỗi race condition trong thư viện HTTP phổ biến (hyper) có thể gây ra vấn đề nghiêm trọng trong ứng dụng thực tế, đặc biệt khi kết hợp với các điều kiện concurrency và giao thức socket, và cách team phát hiện, debug và fix bằng cách quan sát syscall thực tế.

The post-quantum EO is an important milestone. Now it’s time to get to work

Sắc lệnh hành pháp 14409 của Mỹ yêu cầu các cơ quan liên bang và nhà thầu phải chuyển sang mã hóa hậu lượng tử (PQC) vào năm 2030 và xác thực hậu lượng tử vào năm 2031, nhằm ngăn chặn các cuộc tấn công "thu thập giờ đây giải mã sau". Cloudflare khuyến nghị cần làm rõ tiêu chuẩn "chuyển đổi", ưu tiên khả năng thích ứng mật mã (crypto agility) và thúc đẩy sự thống nhất toàn cầu về thuật toán NIST để tránh phân mảnh.

Lập trình viên nên đọc bài này để hiểu cách chuyển đổi sang các giải pháp mã hóa chống lượng tử (post-quantum) không chỉ là một yêu cầu pháp lý mà là một chiến lược bảo mật cấp hệ thống, giúp bảo vệ ứng dụng của bạn trước các mối đe dọa tương lai từ máy tính lượng tử trong thời gian ngắn nhất.

How Cloudflare Solved a Congestion Bug in quiche

Cloudflare engineers uncovered a bug in their Rust-based CUBIC congestion control implementation within quiche, their open-source QUIC library. The bug caused a never-ending recovery loop when heavy packet loss occurred at connection start, preventing the congestion window from growing. Through instrumented testing with simulated 30% packet loss, they traced the root cause to how CUBIC calculated idle time — when in-flight bytes dropped to zero during a noisy slow start, the idle period optimisation became self-reinforcing, locking the state in recovery. The fix was elegant: measure idle time from both the last sent data and the last ACK received, breaking the cycle and restoring a 100% test pass rate.

How we built saga rollbacks for Cloudflare Workflows

Cloudflare Workflows now supports saga-style rollbacks, letting developers attach compensation logic directly to each step.do() call. When a multi-step workflow fails, registered rollback handlers execute in reverse step-start order, each running through Workflows' durable step machinery with retries, timeouts, and lifecycle events. The post explains the API design decisions (fluent vs. builder vs. options object), how rollback handlers are stored as callable stubs, how replay rebuilds handlers after engine restarts, and the key behavioral rules around ordering and eligibility for failed steps.

Cloudflare Ships Agent Skills for Zero Trust Deployment and Migration

Cloudflare released the Cloudflare One stack, an open-source library of agent skills that enables AI agents to plan, deploy, manage, and migrate Zero Trust environments. The library ships as two lightweight files: one for product guidance and one for vendor-to-vendor migration, with explicit logic for migrating from Zscaler and Palo Alto Networks. The migration logic is the same used in Cloudflare's Descaler and Deskope programs, which have moved enterprise customers in hours rather than months. When paired with the Cloudflare MCP server, agents can query live account configurations and make changes through curated workflows. The stack uses a review-before-apply pattern so practitioners approve changes before they are committed.

Cloudflare R2: object storage without egress fees

Cloudflare R2 is S3-compatible object storage with no egress fees, making it cost-effective for serving files at scale. This guide covers how to use R2 from a Cloudflare Worker: creating a bucket via Wrangler, storing binary uploads with a key, reading objects back as streams, setting content-type metadata, listing objects by prefix, and deleting them. It also notes the option to attach a custom domain for direct public serving without a Worker.

Unlocking the Cloudflare app ecosystem with OAuth for all

Cloudflare has opened self-managed OAuth to all developers, allowing anyone to create OAuth applications and build integrations on top of the Cloudflare API. Previously, third-party OAuth was limited to a small number of manually onboarded partners. To make this possible, Cloudflare executed a zero-downtime migration of its underlying OAuth engine (Ory Hydra) from an older version to 2.X using a blue-green deployment strategy. Key engineering challenges included avoiding exclusive table locks during schema migrations (solved with CREATE INDEX CONCURRENTLY), handling refresh token invalidation issues, and preserving revocation events during the cutover window using Cloudflare Queues. The upgrade resulted in significant performance improvements: API P95 latency dropped 45% (185ms to 101ms), Go heap allocation fell 40%, and CPU usage dropped 37%.

Cloudflare KV: a key-value store for your Workers

Cloudflare Workers KV is an edge key-value store that lets you store and retrieve data globally with very low read latency. The guide covers creating a KV namespace, binding it to a Worker via wrangler.jsonc, and using the put/get/delete/list API. It also covers storing JSON objects, setting TTL-based key expiration for sessions and caches, and listing keys by prefix. A key caveat: KV is optimized for read-heavy workloads — writes propagate across regions within a few seconds, making it unsuitable for data requiring immediate consistency (e.g., financial records). For those cases, Cloudflare D1 or Durable Objects are recommended.

Wrangler: the Cloudflare Workers command line tool

Wrangler is the CLI for Cloudflare Workers, used to run code locally, deploy, stream logs, manage secrets, and provision resources like D1 databases, KV, R2, and Queues. Key commands covered include wrangler dev for local development, wrangler deploy for publishing, wrangler tail for live log streaming, wrangler secret put for secure credential storage, and wrangler types for TypeScript binding generation. The config file wrangler.jsonc drives all behavior, and named environments allow separate staging and production setups.

Cloudflare D1: a SQL database for your Workers

A practical guide to using Cloudflare D1, a SQLite-based SQL database for Cloudflare Workers. Covers creating a database with Wrangler, configuring bindings in wrangler.jsonc, managing schema changes with migrations, and querying data from a Worker using prepare/bind/all/run/first/batch APIs. Also explains when to use D1 versus R2 or KV.

Serving a website with Cloudflare Workers static assets

Cloudflare Workers can serve entire websites using the static assets feature, not just API calls. By pointing a Worker at a folder in wrangler.json, static files are served from the edge for free with no Worker code required. For SPAs, the not_found_handling: single-page-application option routes all unknown paths to index.html. When dynamic logic is needed, a Worker can be added alongside static assets, with control over whether the Worker or static files take priority per route. For Astro apps, the official Cloudflare adapter handles the full setup automatically, producing a static client folder plus a Worker for server-rendered routes, all deployed with a single wrangler deploy command.

Cloudflare-First Networking as Code with Pulumi

A tutorial on building a version-controlled Cloudflare edge baseline using Pulumi and TypeScript. Covers defining DNS records, WAF custom rules, a Cloudflare Worker canary for header validation, and Zero Trust Access policies — all as code. Includes a complete TypeScript Pulumi program and validation steps to confirm each component works correctly after deployment.