Skip to content

Commit 381401a

Browse files
mikenomitchmikenomitch
authored
Adds tls and crypto updates for node and changelog (#21482)
Adds tls and crypto updates for node and changelog
1 parent 34d8eda commit 381401a

File tree

5 files changed

+130
-133
lines changed

5 files changed

+130
-133
lines changed

‎src/content/changelog/workers/2025-01-28-nodejs-compat-improvements.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ export default {
4141
````
4242
</TypeScriptExample>
4343

44-
Additionally, you can now use other APIs incliding [`net.BlockList`](https://nodejs.org/api/net.html#class-netblocklist) and
44+
Additionally, you can now use other APIs including [`net.BlockList`](https://nodejs.org/api/net.html#class-netblocklist) and
4545
[`net.SocketAddress`](https://nodejs.org/api/net.html#class-netsocketaddress).
4646

4747
Note that [`net.Server`](https://nodejs.org/api/net.html#class-netserver) is not supported.

‎src/content/changelog/workers/2025-02-03-workers-metrics-revamp.mdx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
---
2-
title: Revamped Workers Metrics
2+
title: Revamped Workers Metrics
33
description: Monitor your Worker's performance with a default set of automatically enabled metrics.
44
products:
55
- workers
66
date: 2025-02-03T18:00:00Z
77
---
88

9-
We've revamped the [Workers Metrics dashboard](https://dash.cloudflare.com/?to=/:account/workers/services/view/:worker/production/metrics/).
9+
We've revamped the [Workers Metrics dashboard](https://dash.cloudflare.com/?to=/:account/workers/services/view/:worker/production/metrics/).
1010

1111
![Workers Metrics dashboard](~/assets/images/workers/observability/workers-metrics.png)
1212

1313
Now you can easily compare metrics across Worker versions, understand the current state of a [gradual deployment](/workers/configuration/versions-and-deployments/gradual-deployments/), and review key Workers metrics in a single view. This new interface enables you to:
1414

15-
- Drag-and-select using a graphical timepicker for precise metric selection.
15+
- Drag-and-select using a graphical timepicker for precise metric selection.
1616

1717
![Workers Metrics graphical timepicker](~/assets/images/workers/observability/metrics-graphical-timepicker.png)
1818

‎src/content/changelog/workers/2025-04-08-nodejs-crypto-and-tls.mdx‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
title: Improved support for Node.js Crypto and TLS APIs in Workers
3+
description: Node.js APIs from the node:crypto and node:tls modules are now available when using nodejs_compat.
4+
products:
5+
- workers
6+
date: 2025-04-08T14:00:00Z
7+
hidden: true
8+
---
9+
10+
import { Render, PackageManagers, TypeScriptExample } from "~/components";
11+
12+
When using a Worker with the [`nodejs_compat`](/workers/runtime-apis/nodejs/) compatibility flag enabled,
13+
the following Node.js APIs are now available:
14+
15+
- [`node:crypto`](/workers/runtime-apis/nodejs/crypto/)
16+
- [`node:tls`](/workers/runtime-apis/nodejs/tls/)
17+
18+
This make it easier to reuse existing Node.js code in Workers or use npm packages that depend on these APIs.
19+
20+
#### node:crypto
21+
22+
The full [`node:crypto`](https://nodejs.org/api/crypto.html) API is now available in Workers.
23+
24+
You can use it to verify and sign data:
25+
26+
```js
27+
import { sign, verify } from "node:crypto";
28+
29+
const signature = sign("sha256", "-data to sign-", env.PRIVATE_KEY);
30+
const verified = verify("sha256", "-data to sign-", env.PUBLIC_KEY, signature);
31+
```
32+
33+
Or, to encrypt and decrypt data:
34+
35+
```js
36+
import { publicEncrypt, privateDecrypt } from "node:crypto";
37+
38+
const encrypted = publicEncrypt(env.PUBLIC_KEY, "some data");
39+
const plaintext = privateDecrypt(env.PRIVATE_KEY, encrypted);
40+
```
41+
42+
See the [`node:crypto` documentation](/workers/runtime-apis/nodejs/crypto/) for more information.
43+
44+
#### node:tls
45+
46+
The following APIs from `node:tls` are now available:
47+
48+
- [`connect`](https://nodejs.org/api/tls.html#tlsconnectoptions-callback)
49+
- [`TLSSocket`](https://nodejs.org/api/tls.html#class-tlstlssocket)
50+
- [`checkServerIdentity`](https://nodejs.org/api/tls.html#tlscheckserveridentityhostname-cert)
51+
- [`createSecureContext`](https://nodejs.org/api/tls.html#tlscreatesecurecontextoptions)
52+
53+
This enables secure connections over TLS (Transport Layer Security) to external services.
54+
55+
```js
56+
import { connect } from "node:tls";
57+
58+
// ... in a request handler ...
59+
const connectionOptions = { key: env.KEY, cert: env.CERT };
60+
const socket = connect(url, connectionOptions, () => {
61+
if (socket.authorized) {
62+
console.log("Connection authorized");
63+
}
64+
});
65+
66+
socket.on("data", (data) => {
67+
console.log(data);
68+
});
69+
70+
socket.on("end", () => {
71+
console.log("server ends connection");
72+
});
73+
```
74+
75+
See the [`node:tls` documentation](/workers/runtime-apis/nodejs/tls/) for more information.

‎src/content/docs/workers/runtime-apis/nodejs/crypto.mdx‎

Lines changed: 8 additions & 129 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
pcx_content_type: configuration
3-
title: Crypto
3+
title: crypto
44
---
55

66
import { Render } from "~/components";
@@ -9,134 +9,13 @@ import { Render } from "~/components";
99

1010
The `node:crypto` module provides cryptographic functionality that includes a set of wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify functions.
1111

12-
A subset of the `node:crypto` module is available in Workers. All APIs in the tables below with a ✅ are supported, and unless otherwise noted, work the same way as the implementations in Node.js.
12+
All `node:crypto` APIs are fully supported in Workers with the following exceptions:
1313

14-
The [WebCrypto API](/workers/runtime-apis/web-crypto/) is also available within Cloudflare Workers.
14+
- The functions [generateKeyPair](https://nodejs.org/api/crypto.html#cryptogeneratekeypairtype-options-callback) and [generateKeyPairSync](https://nodejs.org/api/crypto.html#cryptogeneratekeypairsynctype-options)
15+
do not support DSA or DH key pairs.
16+
- `ed448` and `x448` curves are not supported.
1517

16-
## Classes
18+
The full `node:crypto` API is documented in the [Node.js documentation for `node:crypto`](https://nodejs.org/api/crypto.html).
1719

18-
| API | Supported? | Notes |
19-
| --------------------------------------------------------------------------------- | ---------- | ----- |
20-
| [Certificate](https://nodejs.org/api/crypto.html#class-certificate) | ✅ | |
21-
| [Cipher](https://nodejs.org/api/crypto.html#class-cipher) | | |
22-
| [Decipher](https://nodejs.org/api/crypto.html#class-decipher) | | |
23-
| [DiffieHellman](https://nodejs.org/api/crypto.html#class-diffiehellman) | ✅ | |
24-
| [DiffieHellmanGroup](https://nodejs.org/api/crypto.html#class-diffiehellmangroup) | ✅ | |
25-
| [ECDH](https://nodejs.org/api/crypto.html#class-ecdh) | | |
26-
| [Hash](https://nodejs.org/api/crypto.html#class-hash) | ✅ | |
27-
| [Hmac](https://nodejs.org/api/crypto.html#class-hmac) | ✅ | |
28-
| [KeyObject](https://nodejs.org/api/crypto.html#class-keyobject) | ✅ | |
29-
| [Sign](https://nodejs.org/api/crypto.html#class-sign) | | |
30-
| [Verify](https://nodejs.org/api/crypto.html#class-verify) | | |
31-
| [X509Certificate](https://nodejs.org/api/crypto.html#class-x509certificate) | ✅ | |
32-
| [constants](https://nodejs.org/api/crypto.html#cryptoconstants) | | |
33-
34-
## Primes
35-
36-
| API | Supported? | Notes |
37-
| -------------------------------------------------------------------------------------------- | ---------- | ----- |
38-
| [checkPrime](https://nodejs.org/api/crypto.html#cryptocheckprimecandidate-options-callback) | ✅ | |
39-
| [checkPrimeSync](https://nodejs.org/api/crypto.html#cryptocheckprimesynccandidate-options) | ✅ | |
40-
| [generatePrime](https://nodejs.org/api/crypto.html#cryptogenerateprimesize-options-callback) | ✅ | |
41-
| [generatePrimeSync](https://nodejs.org/api/crypto.html#cryptogenerateprimesyncsize-options) | ✅ | |
42-
43-
## Ciphers
44-
45-
| API | Supported? | Notes |
46-
| ----------------------------------------------------------------------------------------------------- | ---------- | ------------------------------------------ |
47-
| [createCipher](https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options) | | Deprecated, use `createCipheriv` instead |
48-
| [createCipheriv](https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options) | | |
49-
| [createDecipher](https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options) | | Deprecated, use `createDecipheriv` instead |
50-
| [createDecipheriv](https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options) | | |
51-
| [privateDecrypt](https://nodejs.org/api/crypto.html#cryptoprivatedecryptprivatekey-buffer) | | |
52-
| [privateEncrypt](https://nodejs.org/api/crypto.html#cryptoprivateencryptprivatekey-buffer) | | |
53-
| [publicDecrypt](https://nodejs.org/api/crypto.html#cryptopublicdecryptkey-buffer) | | |
54-
| [publicEncrypt](https://nodejs.org/api/crypto.html#cryptopublicencryptkey-buffer) | | |
55-
56-
## DiffieHellman
57-
58-
| API | Supported? | Notes |
59-
| ----------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----- |
60-
| [createDiffieHellman(prime)](https://nodejs.org/api/crypto.html#cryptocreatediffiehellmanprime-primeencoding-generator-generatorencoding) | ✅ | |
61-
| [createDiffieHellman(primeLength)](https://nodejs.org/api/crypto.html#cryptocreatediffiehellmanprimelength-generator) | ✅ | |
62-
| [createDiffieHellmanGroup](https://nodejs.org/api/crypto.html#cryptocreatediffiehellmangroupname) | ✅ | |
63-
| [createECDH](https://nodejs.org/api/crypto.html#cryptocreateecdhcurvename) | | |
64-
| [diffieHellman](https://nodejs.org/api/crypto.html#cryptodiffiehellmanoptions) | | |
65-
| [getDiffieHellman](https://nodejs.org/api/crypto.html#cryptogetdiffiehellmangroupname) | ✅ | |
66-
67-
## Hash
68-
69-
| API | Supported? | Notes |
70-
| -------------------------------------------------------------------------------------- | ---------- | ----- |
71-
| [createHash](https://nodejs.org/api/crypto.html#cryptocreatehashalgorithm-options) | ✅ | |
72-
| [createHmac](https://nodejs.org/api/crypto.html#cryptocreatehmacalgorithm-key-options) | ✅ | |
73-
| [getHashes](https://nodejs.org/api/crypto.html#cryptogethashes) | ✅ | |
74-
75-
## Keys
76-
77-
| API | Supported? | Notes |
78-
| ------------------------------------------------------------------------------------------------ | ---------- | ----- |
79-
| [createPrivateKey](https://nodejs.org/api/crypto.html#cryptocreateprivatekeykey) | ✅ | |
80-
| [createPublicKey](https://nodejs.org/api/crypto.html#cryptocreatepublickeykey) | ✅ | |
81-
| [createSecretKey](https://nodejs.org/api/crypto.html#cryptocreatesecretkeykey-encoding) | ✅ | |
82-
| [generateKey](https://nodejs.org/api/crypto.html#cryptogeneratekeytype-options-callback) | ✅ | |
83-
| [generateKeyPair](https://nodejs.org/api/crypto.html#cryptogeneratekeypairtype-options-callback) | ✅ | Does not support DSA or DH key pairs |
84-
| [generateKeyPairSync](https://nodejs.org/api/crypto.html#cryptogeneratekeypairsynctype-options) | ✅ | Does not support DSA or DH key pairs |
85-
| [generateKeySync](https://nodejs.org/api/crypto.html#cryptogeneratekeysynctype-options) | ✅ | |
86-
87-
## Sign/Verify
88-
89-
| API | Supported? | Notes |
90-
| ---------------------------------------------------------------------------------------------- | ---------- | ----- |
91-
| [createSign](https://nodejs.org/api/crypto.html#cryptocreatesignalgorithm-options) | | |
92-
| [createVerify](https://nodejs.org/api/crypto.html#cryptocreateverifyalgorithm-options) | | |
93-
| [sign](https://nodejs.org/api/crypto.html#cryptosignalgorithm-data-key-callback) | | |
94-
| [verify](https://nodejs.org/api/crypto.html#cryptoverifyalgorithm-data-key-signature-callback) | | |
95-
96-
## Misc
97-
98-
| API | Supported? | Notes |
99-
| ---------------------------------------------------------------------------------------- | ---------- | ----- |
100-
| [getCipherInfo](https://nodejs.org/api/crypto.html#cryptogetcipherinfonameornid-options) | | |
101-
| [getCiphers](https://nodejs.org/api/crypto.html#cryptogetciphers) | ✅ | |
102-
| [getCurves](https://nodejs.org/api/crypto.html#cryptogetcurves) | ✅ | |
103-
| [secureHeapUsed](https://nodejs.org/api/crypto.html#cryptosecureheapused) | ✅ | |
104-
| [setEngine](https://nodejs.org/api/crypto.html#cryptosetengineengine-flags) | ✅ | |
105-
| [timingSafeEqual](https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b) | ✅ | |
106-
107-
## Fips
108-
109-
| API | Supported? | Notes |
110-
| --------------------------------------------------------------- | ---------- | ----------------------------------- |
111-
| [getFips](https://nodejs.org/api/crypto.html#cryptogetfips) | ✅ | |
112-
| [fips](https://nodejs.org/api/crypto.html#cryptofips) | ✅ | Deprecated, use `getFips()` instead |
113-
| [setFips](https://nodejs.org/api/crypto.html#cryptosetfipsbool) | ✅ | |
114-
115-
## Random
116-
117-
| API | Supported? | Notes |
118-
| -------------------------------------------------------------------------------------------- | ---------- | ----- |
119-
| [getRandomValues](https://nodejs.org/api/crypto.html#cryptogetrandomvaluestypedarray) | ✅ | |
120-
| [randomBytes](https://nodejs.org/api/crypto.html#cryptorandombytessize-callback) | ✅ | |
121-
| [randomFillSync](https://nodejs.org/api/crypto.html#cryptorandomfillsyncbuffer-offset-size) | ✅ | |
122-
| [randomFill](https://nodejs.org/api/crypto.html#cryptorandomfillbuffer-offset-size-callback) | ✅ | |
123-
| [randomInt](https://nodejs.org/api/crypto.html#cryptorandomintmin-max-callback) | ✅ | |
124-
| [randomUUID](https://nodejs.org/api/crypto.html#cryptorandomuuidoptions) | ✅ | |
125-
126-
## Key Derivation
127-
128-
| API | Supported? | Notes |
129-
| ------------------------------------------------------------------------------------------------------------ | ---------- | ------------------------------ |
130-
| [hkdf](https://nodejs.org/api/crypto.html#cryptohkdfdigest-ikm-salt-info-keylen-callback) | ✅ | Does not yet support KeyObject |
131-
| [hkdfSync](https://nodejs.org/api/crypto.html#cryptohkdfsyncdigest-ikm-salt-info-keylen) | ✅ | Does not yet support KeyObject |
132-
| [pbkdf2](https://nodejs.org/api/crypto.html#cryptopbkdf2password-salt-iterations-keylen-digest-callback) | ✅ | |
133-
| [pbkdf2Sync](https://nodejs.org/api/crypto.html#cryptopbkdf2password-salt-iterations-keylen-digest-callback) | ✅ | |
134-
| [scrypt](https://nodejs.org/api/crypto.html#cryptoscryptpassword-salt-keylen-options-callback) | ✅ | |
135-
| [scryptSync](https://nodejs.org/api/crypto.html#cryptoscryptsyncpassword-salt-keylen-options) | ✅ | |
136-
137-
## WebCrypto
138-
139-
| API | Supported? | Notes |
140-
| --------------------------------------------------------- | ---------- | ----- |
141-
| [subtle](https://nodejs.org/api/crypto.html#cryptosubtle) | ✅ | |
142-
| [webcrypto](https://nodejs.org/api/crypto.html#) | ✅ | |
20+
The [WebCrypto API](/workers/runtime-apis/web-crypto/) is also available within Cloudflare Workers. This does not
21+
require the `nodejs_compat` compatibility flag.

‎src/content/docs/workers/runtime-apis/nodejs/tls.mdx‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
pcx_content_type: configuration
3+
title: tls
4+
---
5+
6+
import { Render, TypeScriptExample } from "~/components";
7+
8+
<Render file="nodejs-compat-howto" />
9+
10+
You can use [`node:tls`](https://nodejs.org/api/tls.html) to create secure connections to
11+
external services using [TLS](https://developer.mozilla.org/en-US/docs/Web/Security/Transport_Layer_Security) (Transport Layer Security).
12+
13+
```js
14+
import { connect } from "node:tls";
15+
16+
// ... in a request handler ...
17+
const connectionOptions = { key: env.KEY, cert: env.CERT };
18+
const socket = connect(url, connectionOptions, () => {
19+
if (socket.authorized) {
20+
console.log("Connection authorized");
21+
}
22+
});
23+
24+
socket.on("data", (data) => {
25+
console.log(data);
26+
});
27+
28+
socket.on("end", () => {
29+
console.log("server ends connection");
30+
});
31+
```
32+
33+
The following APIs are available:
34+
35+
- [`connect`](https://nodejs.org/api/tls.html#tlsconnectoptions-callback)
36+
- [`TLSSocket`](https://nodejs.org/api/tls.html#class-tlstlssocket)
37+
- [`checkServerIdentity`](https://nodejs.org/api/tls.html#tlscheckserveridentityhostname-cert)
38+
- [`createSecureContext`](https://nodejs.org/api/tls.html#tlscreatesecurecontextoptions)
39+
40+
All other APIs, including [`tls.Server`](https://nodejs.org/api/tls.html#class-tlsserver) and [`tls.createServer`](https://nodejs.org/api/tls.html#tlscreateserveroptions-secureconnectionlistener),
41+
are not supported and will throw a `Not implemented` error when called.
42+
43+
The full `node:tls` API is documented in the [Node.js documentation for `node:tls`](https://nodejs.org/api/tls.html).

0 commit comments

Comments
 (0)