- replace the obsolete document-domain policy with Origin-Agent-Cluster - document the Free-plan RUM exclusion and add regression coverage
- commit
- 90f7f29da832b3a9424ebe4a4ab3fcf22a536898
- parent
- 7c17e9de82229b4ec236204c37a4f7ce326e93fe
- author
- Dami <dami.etoile@gmail.com>
| M | worker/ | 21 | ++++++++++++++++++++- |
| M | worker/ | 2 | +- |
| M | worker/ | 5 | ++--- |
| M | worker/ | 2 | ++ |
@@ -59,7 +59,9 @@ nzip uses two public surfaces:
5959 The control path permanently redirects to the artifact hostname; it never serves6060 artifact bytes. This separation gives every hosted site its own browser storage,6161 service workers, host-only nzip unlock cookie, and default passkey relying-party62-ID.62+ID. Artifact responses also send `Origin-Agent-Cluster: ?1` so browsers keep63+each site in an origin-keyed agent cluster. Do not replace it with the obsolete64+`Permissions-Policy: document-domain=()` directive.6365 6466 New site builds should use `/` as their deployment base; the address is no6567 longer part of the asset path and no reservation/rebuild/repush cycle is needed.@@ -119,6 +121,23 @@ rate-limit bindings remain authoritative for address enumeration and
119121 `POST /__unlock`, so the optional edge rule does not consume the Free plan's120122 single rate-limit rule.121123 124+### Free-plan RUM exclusion125+126+Cloudflare can automatically inject its Real User Monitoring beacon into HTML127+on Free-plan zones. Hosted artifacts should remain byte-for-byte static and128+should not produce `/cdn-cgi/rum` requests during PWA reloads. Add a129+Configuration Rule named `nzip: disable RUM on artifact hosts` with this130+expression:131+132+```text133+ends_with(lower(http.host), ".n.zip")134+```135+136+Set its action to **Disable Real User Monitoring (RUM)**. Adapt the suffix for137+other zones. This keeps RUM available on the control origin while disabling it138+for every isolated artifact hostname. Use a Configuration Rule for this on the139+Free plan; per-host Web Analytics rules are not included there.140+122141 Enable `Always Use HTTPS` for the entire zone. Once every wildcard hostname has123142 a valid certificate, enable HSTS with a real duration; begin without `preload`,124143 verify the deployment, and only then consider a one-year duration plus preload.@@ -301,9 +301,8 @@ describe("Worker runtime", () => {
301301 expect(isolated.headers.get("cloudflare-cdn-cache-control")).toBe(302302 "no-store",303303 );304- expect(isolated.headers.get("permissions-policy")).toBe(305- "document-domain=()",306- );304+ expect(isolated.headers.get("permissions-policy")).toBeNull();305+ expect(isolated.headers.get("origin-agent-cluster")).toBe("?1");307306 const stored = await env.DB.prepare(308307 "SELECT expires_at, password_hash FROM sites WHERE address = ?",309308 ).bind(address).first<@@ -131,6 +131,8 @@ test("canonical directory URL serves its index without redirecting", async () =>
131131 assert.equal(response.headers.get("location"), null);132132 assert.equal(response.headers.get("cache-control"), "public, max-age=60");133133 assert.equal(response.headers.get("cache-tag"), "nzip-site-2f9b");134+ assert.equal(response.headers.get("permissions-policy"), null);135+ assert.equal(response.headers.get("origin-agent-cluster"), "?1");134136 });135137 136138 test("missing index path still returns not found", async () => {