Cloudflare Proxy Worker
You build a cloudflare proxy worker by writing an edge script that forwards web requests. The script catches incoming client calls, changes the target URL, and sends back the response. Teams use this setup to hide origin servers and add custom headers at the edge. When edge rules are too broad, users can reach private API paths by mistake. How a cloudflare proxy worker routes traffic An edge worker runs on global servers close to your end users. When a user sends a web request, the edge serve
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You build a cloudflare proxy worker by writing an edge script that forwards web requests. The script catches incoming client calls, changes the target URL, and sends back the response. Teams use this setup to hide origin servers and add custom headers at the edge. When edge rules are too broad, users can reach private API paths by mistake.
How a cloudflare proxy worker routes traffic
An edge worker runs on global servers close to your end users. When a user sends a web request, the edge server catches it first. The worker script reads the incoming URL, headers, and method before taking action. Your team can set up the script to pick a backend server based on paths. For example, one path goes to a storage bucket while another goes to an app.
Next, the script builds a new request and sends it to the origin host. It can add secret API keys or strip out tracking headers during this step. The origin server processes the call and returns data to the edge script. Then the worker modifies the response headers and sends the payload to the user. This flow keeps the real server address hidden from the public internet.
Manage headers and permissions at the edge
Teams often use edge scripts to check user tokens before forwarding web traffic. The worker inspects a header or cookie to see if the user logged in. If the check fails, the script blocks the call right at the network edge. This stops bad web traffic before it ever reaches your core backend servers.
You also have to manage the permissions of the team that deploys these scripts. Admin roles in your edge account can read secret keys stored in the script settings. If too many developers share one admin role, anyone can change the routing rules. A small mistake in a routing rule can expose internal web paths to the public. Teams should limit who can publish scripts and rotate edge secret keys often.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What edge scripts solve and what they leave open
An edge script is great for routing public HTTP traffic and rewriting web headers. It helps teams combine many microservices under one clean domain name for users. It also blocks basic web attacks and caches static files close to the client. For standard web apps, this setup handles public traffic routing very well.
Still, an edge script only manages web requests at the outer network border. It does not govern how engineers or apps run queries inside your private databases. Edge workers decide where a web request goes, not what an internal query does. Once a request passes the edge, the worker cannot inspect SQL statements or shell commands. It also cannot mask sensitive fields like emails, phone numbers, or card numbers in results. To control internal data queries and server commands, teams need controls closer to the resource.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev sits inline in the wire protocol beside those services as an open-source proxy, a sidecar for your Postgres or API. On every query an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human review.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What is the main use case for an edge worker script?
Teams use edge scripts to route HTTP requests to different origin servers based on URLs. They also use them to add custom security headers and rewrite legacy web paths.
Can an edge worker protect internal database queries?
No, an edge worker only handles web requests at the public network border. It does not inspect or control direct SQL queries or shell commands from internal users.
How do teams secure secret keys used in edge scripts?
Teams store secret keys in encrypted edge variables rather than plain text script files. They also restrict account roles so only a few admins can view or update keys.