Say goodbye to false 403s on Workers subrequests to BYOIP destinations!
Hi, it's Shii-chan! This fix is quiet, but it matters for how your security rules behave!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
According to the Cloudflare Changelog, Cloudflare now preserves Workers context when a Workers subrequest targets a Cloudflare-proxied hostname that uses Bring Your Own IP (BYOIP). These requests are identified as Cloudflare-to-Cloudflare traffic instead of external Internet traffic.
The story so far
Some BYOIP subrequests could lose Workers context and the original client signals. That could lead to:
- Security rules behaving unexpectedly
- Bot Management evaluating an internal Cloudflare connection instead of the original client
- Affected requests returning false 403 responses
What changes
Workers subrequests to BYOIP destinations now preserve the CF-Worker header and the cf.worker.upstream_zone field. That supports consistent security rule evaluation across same-zone and cross-zone subrequests.
Dive Deep
- Bot Management fields on the destination zone now represent the original end-user connection for affected BYOIP subrequests
- Bot scores, verified bot status, and JA3/JA4 fingerprints no longer represent the internal connection between Cloudflare services
- The improvement is automatic and needs no configuration changes
Wrap-up
- Workers context is preserved for subrequests to BYOIP destinations
- Rule evaluation is consistent and Bot Management results are more accurate
- Fewer unexpected failures such as false 403s
This is for anyone calling BYOIP-backed hostnames from Workers!
