Cloudflare Workers Proxy
You build a cloudflare workers proxy by deploying a short script at the network edge. This script catches user traffic, rewrites the target URL, and forwards the request. Development teams use this setup to route API calls and hide backend hostnames. They also use it to add custom headers before traffic hits origin servers. Problems start when one edge script gets broad network reach to internal backends. Any caller who passes the basic edge check can then send unsafe requests. How a cloudflar
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You build a cloudflare workers proxy by deploying a short script at the network edge. This script catches user traffic, rewrites the target URL, and forwards the request. Development teams use this setup to route API calls and hide backend hostnames. They also use it to add custom headers before traffic hits origin servers. Problems start when one edge script gets broad network reach to internal backends. Any caller who passes the basic edge check can then send unsafe requests.
How a cloudflare workers proxy routes traffic at the edge
An edge script runs in data centers close to the end user. When a browser sends a web request, the nearest edge node catches it first. The script reads the incoming URL path, query string, and request headers. Your code then creates a new request object pointed at your backend service.
Teams often change headers during this step to clean up the traffic. You can strip out client cookies or add a shared header for the origin. Next, the edge script uses the standard fetch API to call the origin server. The origin processes the call and sends a response back to the edge node.
The edge script can also edit the response before the user receives it. Teams add cross-origin headers or remove server version banners at this stage. You assign the script to a specific domain route in your DNS dashboard. Only traffic that matches your chosen URL pattern will run through the script. Static files can bypass the script while API paths run your custom routing logic.
Routing external requests across multiple backend services
Many teams split one old web app into several smaller backend services. A single domain still needs to serve all of those backend services to users. An edge script lets you map different URL paths to different origin hosts. Traffic for the billing path goes to one cloud host. Traffic for the user profile path goes to a separate host.
The client browser sees one clean domain name for every single request. You do not need to expose internal hostnames or manage complex cross-origin rules. When teams move a service to a new cloud host, they update the script. The transition happens at the edge without waiting for user DNS caches to clear.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What edge scripts solve and what gaps remain
An edge script handles public web routing and basic header changes well. It absorbs public traffic spikes and keeps origin IP addresses off public DNS records. It also lets teams test new web backends by shifting small slices of traffic.
Still, an edge script only checks the outer HTTP wrapper of a web request. It decides if a web request can reach a backend host. It does not inspect database queries or admin commands inside internal engineering workflows. Once a request passes the edge check, the backend runs whatever payload arrives.
Edge scripts also only handle HTTP traffic and standard web socket streams. Engineers still need direct paths to run SQL queries or debug production servers. If you open broad network paths for those tasks, static keys spread across laptops. A script at the public edge cannot govern what an engineer runs inside databases. It also cannot mask sensitive fields like emails, phone numbers, or card numbers in results.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev sits inline in the protocol beside each supported service as an open-source proxy, a sidecar for your database or API. For every query or command an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human approval.
First, hoop.dev guardrails block banned queries before they run or hold risky ones for review, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
When should a team use an edge script for routing?
Use an edge script when you need to route public HTTP traffic across hosts. It works well for header rewrites, URL redirects, and joining separate web apps.
Can an edge script handle non-HTTP database traffic?
No, edge scripts are built for web traffic and standard web requests. They do not inspect raw database protocols or govern interactive terminal sessions for engineers.
What is the main security risk of a custom routing script?
A flawed routing rule can let outside callers reach internal endpoints by mistake. Also, edge scripts do not redact sensitive data fields inside backend query responses.