Nakonfigurujte Worker

curl https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/certs -s | jq .keys

[
  {
    "kid": "ca96ae653935dbfb49b4e19de600cc5f9d5c63e3ac2dbee406ed4bf0ae100cce",
    "kty": "RSA",
    "alg": "RS256",
    "use": "sig",
    "e": "AQAB",
    "n": "9dG9Ph4ffncvEA9FO9pVMfJ1dh_5mtuyiIE4ap9ScrufVPq1I34St_dhcFavKiytK7Id7gTlgQgaouoJ0I5OJ_bytgX-B7oOUQHO-nJOAMycORXN8ZNaMBPKg9nBLL_BFY0YX5HggqrkXkZjJ--R4JpB30ENS8A6hxmEJ__yGMZTE2LHZoiYj9iyGNu3s3JflAoRlmziI8LsFXwyFAJUWRZq4SkSfyrRJ89pXPxIqBn9uYBtnxWzUpWG3xKZu0JAbi9YiwFCJrSe_CarvpARoWsOldtrty5yT1yJ1PZlImlF-yuEwjOoZxeib4WSidABZH0O3pbDACo8MfxR5rghHQ"
  },
  {
    "kid": "1e590a6dcd60e3e2306c21eca19144c59d591531267a3ebde8d521f40894329d",
    "kty": "RSA",
    "alg": "RS256",
    "use": "sig",
    "e": "AQAB",
    "n": "6uj6PgDq-bPsdFjiQ6M3yaxMxBUnnYj20xtLciHNafqrygAjnZKjl8LfCO_mtZ7jxfJNCARsz0L3sF9LAtARZqcsUvYLUlNDzflwNTe8woCT7yw0Ml2ZV5BWDbc3izEQnvjlBDGWv9p5jv-D-YNExtIzZKsRKyoy7hSu5FhyxmPfiAXo8b67f0dNy8V8HZfQJ5i9VGyK4Z5xKM-FjHOrC2uIbhzUE6wDe_0M23RTCxj7ZxzXUzZzc-_EBjmZDAI3tI2zBYymO55_gw8zHrNsZ4-32YvNTjBAiTLsjvKlsvNtPTN8q3saoZJWQMSiMi8dRalgA6pUDgcNs5lB9E7tWw"
  }
]

1. Vytvoření nového Workeru.

2. Zkopírujte a vložte níže uvedený ukázkový kód do nového Workeru a zcela tak nahraďte veškerý stávající kód.

3. ID aktuální zóny nahraďte ID vaší zóny.

4. ID aktuální konfigurace ověřování tokenu nahraďte vlastní konfigurací ověřování tokenu.

5. Adresu URL aktuálního poskytovatele identity nahraďte adresou URL klíče vašeho poskytovatele identity.

6. Pokud adresa URL JWKs vrací klíče v jiném JSON objektu než keys, aktualizujte fetchCredentials() funkci, která vrátí jen klíčová data.

7. Vyberte Vytvořit > Nasadit.

8. V části Worker settings přejděte na Proměnné a přidejte proměnnou prostředí s názvem CF_API_TOKEN s hodnotou API tokenu, který jste vytvořili.

9. V části Worker Triggers přiřaďte Cron Trigger do Workeru. Cloudflare doporučuje častý interval aktualizací, abyste měli vždy nejnovější klíče a aby okamžitá rotace klíčů u vašeho poskytovatele identity způsobila jen minimální výpadek.

   Ukázkový kód v JavaScriptu

   /**
   * Update Token Validation Credentials
   *
   * This example shows how a Cloudflare Workers cron trigger can be used to
   * automatically rotate a JWKs for a Token Configuration.
   *
   * To configure this Worker:
   *
   *   1. Replace `token_config_id` with the ID of the Token Config to update
   *   2. Replace `zone_id` with your Zone ID
   *   3. Replace `url` with a publicly accessible URL with the JWKs you want to use
   *   4. Create a new API Token with "Zone.API Gateway Edit" permissions and add it as a secret with the name `CF_API_TOKEN` (see https://developers.cloudflare.com/workers/configuration/secrets/)
   *
   * This worker also handles GET and POST requests:
   *   - GET will fetch and show the credentials from the provided URL (`GET https://random-worker-name-c134.example.workers.dev/`)
   *   - POST triggers an update and returns the Cloudflare API response of that update (`POST https://random-worker-name-c134.example.workers.dev/`)
   *
   * Use these to test that the Worker is properly configured.
   *
   * After setting up the worker, you can create a cron trigger to run it periodically.
   * For more information on cron triggers, refer to https://developers.cloudflare.com/workers/configuration/cron-triggers/
   *
   * Learn more about Workers at https://developers.cloudflare.com/workers/
   */
   
   var zone_id = "760549bc17c54280d6e6ae256c3dd6ae";
   var token_config_id = "91007e72-8f17-46b7-a223-5e57bd333b78";
   var url = "https://cfdata.cloudflareaccess.com/cdn-cgi/access/certs"; // JWKs
   
   /**
   * fetchCredentials fetches new Token Configuration credentials using the URL defined above.
   * This returns a JSON string with the credentials.
   *
   * Use this function to fetch and parse credentials.
   *
   * @returns {string} credentials
   */
   async function fetchCredentials() {
   	var requestOptions = {
   		method: "GET",
   		redirect: "follow",
   	};
   	const keys = await fetch(url, requestOptions)
   		.then((e) => e.json())
   		.then((e) => e.keys);
   	return JSON.stringify({ keys: keys });
   }
   
   /**
   * updateCredentials updates Token Configuration credentials using the Cloudflare API.
   * Credentials are fetched using fetchCredentials, which also does any required processing.
   *
   * @param {string} bearer Cloudflare API Bearer token with "Zone.API Gateway Edit" permissions
   * @returns {string} Cloudflare API response from the update request
   */
   async function updateCredentials(bearer) {
   	// Cloudflare API endpoint for credentials update
   	const url = `https://api.cloudflare.com/client/v4/zones/${zone_id}/token_validation/config/${token_config_id}/credentials`;
   	const init = {
   		body: await fetchCredentials(),
   		method: "PUT",
   		headers: {
   			Authorization: `Bearer ${bearer}`,
   			"content-type": "application/json;charset=UTF-8",
   		},
   	};
   	const response = await fetch(url, init);
   	return response.text();
   }
   
   // Export a default object containing event handlers
   export default {
   	/**
   	* fetch handles requests made directly to the Worker.
   	*
   	*/
   	async fetch(request, env, ctx) {
   		let responseBody = "";
   		if (request.method === "GET") {
   			responseBody = await fetchCredentials();
   		} else if (request.method === "POST") {
   			responseBody = await updateCredentials(env.CF_API_TOKEN);
   		}
   		return new Response(responseBody, {
   			headers: { "content-type": "application/json;charset=UTF-8" },
   		});
   	},
   
   	/**
   	* scheduled is the handler for cron triggers.
   	*
   	* For details, refer to https://developers.cloudflare.com/workers/configuration/cron-triggers/
   	*
   	*/
   	async scheduled(request, env, ctx) {
   		ctx.waitUntil(updateCredentials(env.CF_API_TOKEN));
   	},
   };