codewithkristian / access Goto Github PK

// put this in config.js and gitignore it, or post-february 2020, use
// workers secrets to set these as AUD and CERTIFICATE_URL constants
// in your script
const config = {
  AUD: "1234abcdef",
  CERTIFICATE_URL: "https://yourdomain.com/cdn-cgi/access/certs",
}

// in your workers script, usually index.js

const access = new Access({
  debug: true,
  verification: {
    aud: config.AUD,
    certificateUrl: config.CERTIFICATE_URL,
  },
})

addEventListener('fetch', handleRequest)

const handleRequest = async evt => {
  // Verifies the provided JWT in the request, ensuring that it's signed
  // by the Cloudflare Access public keys
  const { authorized } = await access.try(evt)
  if (authorized) {
    const resp = await fetch(evt.request)
    const emailHeader = 'cf-access-authenticated-user-email'
    resp.headers.set(emailHeader, evt.request.headers.get(emailHeader))
    return resp
  } else {
    // Return 401 unauthorized - depending on the situation, you may want 
    // to clear the JWT and re-authenticate through Access instead
    return new Response("Unauthorized", { status: 401 })
  }
}