Recipes
Real-world Cloudflare integration patterns
Patterns extracted from production projects using Cloudflare Pages, Workers, and storage services.
In This Section
Astro + Pages -- Deploying Astro static sites to Cloudflare Pages
Search API -- Full-text search with Pages Functions and KV logging
Auth with Pages Functions -- Authentication patterns using Pages Functions
Bot Worker -- webhook bot with immediate ack, bounded tool loop, and TTL KV thread state; see Chat Memory and RAG for durable chat architecture
SSR Bindings Adapter -- per-request Cloudflare bindings via AsyncLocalStorage in an advanced-mode _worker.js
Workers AI Streaming -- streaming SSE proxy with client-disconnect abort and a kill switch; see Workers AI Models and Pricing for model choice
Cron + D1 Queue -- cron-triggered D1 work-queue with backoff and dead-lettering
Cookie Sessions -- HttpOnly cookie sessions with refresh-token rotation
Webhook Signing -- HMAC-SHA256 request signing with Web Crypto
Idempotency-Key Ledger on D1 -- claim-before-mutate idempotency keys with fingerprinting, fenced pending-reservation takeover, and a bounded ledger sweep
SSRF and Redirect Safety -- an outbound-fetch SSRF guard with a full literal-host blocklist, plus percent-decode-safe sanitization for client-supplied redirect targets
Password Gate for Preview and Staging Sites -- a shared-password gate in front of every request, including static assets, with an integrity-checked marker cookie, POST-only login, and a brute-force delay
Personal API Tokens -- hash-only personal API tokens with mint-once secrets, double-guarded soft revoke, session-only management routes, and race-safe last-used tracking on D1
Web Push with VAPID -- send encrypted Web Push notifications from a Worker using VAPID and aes128gcm, no web-push npm package required
Remote MCP Server on Workers -- a stateless remote MCP server on the WebStandard Streamable HTTP transport -- per-request isolate instantiation, a POST-only 405 contract, a body cap enforced before JSON parsing, and a bundle-size check against the SDK's client half
Reverse Proxy to a Fixed Upstream -- header hygiene on both legs, manual redirect rewriting with a cross-request hop cap, an explicit trust-model call on cookies/CSP/HSTS, shared-cache safety, and the workerd Content-Encoding trap