Cloudflare Worker As Proxy
You set up a cloudflare worker as proxy by writing an edge script that forwards requests. The script catches incoming web traffic, changes the target host, and sends the response back. Engineering teams often use this setup to route public calls to backend services. Still, broad routing rules can expose private backend routes to anyone who reaches the edge. How to set up a cloudflare worker as proxy A worker runs on edge servers around the world and waits for incoming web requests. When a use
Database Proxy (ProxySQL, PgBouncer) + Authorization as a Service: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up a cloudflare worker as proxy by writing an edge script that forwards requests. The script catches incoming web traffic, changes the target host, and sends the response back. Engineering teams often use this setup to route public calls to backend services. Still, broad routing rules can expose private backend routes to anyone who reaches the edge.
How to set up a cloudflare worker as proxy
A worker runs on edge servers around the world and waits for incoming web requests. When a user sends a request, the edge script reads the URL path and headers. You then write logic that builds a new request object pointed at your origin server. The script can change headers, strip query strings, or pick a different backend host.
Next, you bind your custom domain route to the worker inside your account settings. Any traffic matching that route hits the edge script before reaching your core servers. You can also store API keys in encrypted edge variables so the script can use them. The worker adds those keys to the outbound request header and waits for the reply.
Once the origin server responds, the worker receives the data payload and status code. Your script can modify response headers, add cross-origin rules, or cache static assets at the edge. Finally, the worker streams the modified response back to the client browser or app. This whole cycle happens near the user, which keeps network hops low for standard web traffic.
Where edge routing works and what it leaves open
Using an edge worker works well for public web routing, header tweaks, and basic URL rewrites. It hides your origin server address from public view and combines several microservices under one domain. Teams also use it to block bad bots or verify basic web tokens at the perimeter.
Still, an edge script only controls web traffic at the perimeter of your network. It does not solve internal access for engineers who run database queries or server commands. If you pass a shared API key through the worker, every allowed caller gets full permissions. The setup decides who reaches the URL, not what individual statements or payloads do in flight.
Database Proxy (ProxySQL, PgBouncer) + Authorization as a Service: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Edge workers also have strict execution time limits and only speak standard web protocols. They are not built to inspect raw database sessions, terminal commands, or sensitive internal records. When a backend returns emails, phone numbers, or card numbers, a basic worker forwards everything intact. Unless you write custom parsing logic for every route, sensitive fields pass straight to the caller.
Keeping edge scripts safe in production
To reduce risk, teams must restrict which paths and methods the edge script will forward. Always check an explicit allowlist of URL paths before sending traffic to an internal service. Strip incoming headers that might trick the backend into trusting a fake user role.
You should also avoid putting broad admin keys inside edge variables that serve public routes. If a route only needs to read public items, give the worker a read-only backend key. Keep detailed logs of failed requests so your team can spot strange traffic patterns early. For internal database queries and sensitive server work, use dedicated controls built for deep session checks.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Can an edge worker handle raw database traffic?
Standard edge workers are built for HTTP web requests rather than persistent raw TCP database sessions. While some drivers wrap queries in HTTP, workers cannot inspect native database wire protocols by default.
How do you stop an edge script from leaking backend secrets?
Store all secrets in encrypted edge variables instead of putting them in your script text. Make sure your script never copies outbound auth headers into the response sent back to clients.
Does an edge worker mask sensitive fields in API responses?
No, a worker passes the full response body through unless you write custom parsing logic. Masking that rewrites matched fields like emails or card numbers in results requires dedicated inspection tools.