Protect Quick Tunnels with Email Auth: Meet cloudflared --allowed-mail!
Hi everyone, it's Shii-chan! Today's news is about sharing things running on your machine, safely!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
In the Cloudflare Changelog, Cloudflare announced that you can now restrict who can access a Quick Tunnel in Cloudflare Tunnel.
A new --allowed-mail flag in cloudflared requires visitors to authenticate with a one-time PIN sent to their email before they reach your local service.
The story so far
Until now, anyone with a trycloudflare.com URL could access the service behind it.
If the URL leaked, your development server was exposed, and that was worrying.
What changes
You can share a local development server, webhook receiver, or demo with specific people only!
And you don't need a Cloudflare account or any domain configuration.
Dive Deep
Here's the basic usage!
cloudflared tunnel --url http://localhost:8080 --allowed-mail alice@example.com
There are three ways to specify who is allowed.
- A single email address:
--allowed-mail alice@example.com - Multiple email addresses, by repeating the flag or using a comma-separated list (
--allowed-mail 'alice@example.com,bob@example.com') - Every address on a domain:
--allowed-mail '*@example.com'
Here are the points to know.
- Visitors don't need a Cloudflare account
- Access ends for everyone when you stop the cloudflared process
- To use it, update cloudflared to the latest version
Wrap-up
- You can protect a Quick Tunnel with email authentication using
--allowed-mail - You can allow a single address, multiple addresses, or a whole domain
- Neither visitor accounts nor domain setup are needed
- Stopping cloudflared ends all access
If you want to show a local demo or webhook receiver only to specific people, this one is for you!
