Add checks for POLICY_AUD #25769
Merged
Add checks for POLICY_AUD #25769
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
lgtm |
kodster28
approved these changes
Oct 10, 2025
jroyal
approved these changes
Oct 10, 2025
workers-devprod
added
the
contribution
|
Congratulations @jillesme, the maintainer of this repository has issued you a holobyte! Here it is: https://holopin.io/holobyte/cmgl76nw700gdk104nb82b62c This badge can only be claimed by you, so make sure that your GitHub account is linked to your Holopin account. You can manage those preferences here: https://holopin.io/account. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
I followed https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/#cloudflare-workers-example without setting the AUD environment variable on accident. That ends up omitting the audience verification entirely. It only verifies if the audience value is set to a truthy value. Even an empty string gets skipped (thanks JavaScript)
I skipped to Go example, because instead of reading from an environment variable, the audience is hard-coded in.
There is also https://github.com/cloudflare/cloudflare-docs/blob/production/src/content/changelog/workers/2025-10-03-one-click-access-for-workers.mdx -- which has the same example. I did not update that yet because I don't know how we feel about retroactively updating changelogs. Happy to update that too.
Screenshots (optional)
Documentation checklist