[workers-auth] Reject misleading Cloudflare Access 302 redirects
Maintainers usually reply within 1 day
@akhil9tiet is already working on this.
Since Nov 6, 2026.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- authentication
Research direction
Start in workers-auth/access.ts and inspect domainUsesAccess(), then review the linked Node.js reproduction. Check how the redirect's Location value is parsed and how supported Cloudflare Access team domains are identified. Done means misleading URLs return false while valid Access redirects still return true; run the relevant workers-auth tests.
Written by the indexing model from the issue text.
Description
What versions & operating system are you using?
Source-level regression in workers-auth/access.ts on main.
Reproduction tested with Node.js v22.16.0 on Linux.
No live Cloudflare Access environment was used.
Please provide a link to a minimal reproduction
https://gist.github.com/aetherxeg-source/f513b2d7deed578bcf60478d6162f8fa
Describe the Bug
The domainUsesAccess() function detects Cloudflare Access when an HTTP 302 response has a Location header containing the substring cloudflareaccess.com.
This can incorrectly classify unrelated redirects, including:
https://team.cloudflareaccess.com.evil.test/loginhttps://unrelated.test/next?url=https://team.cloudflareaccess.com/
Expected: Parse the redirect URL and validate the actual HTTPS hostname against the supported Cloudflare Access team domains.
Actual: The current substring check returns true for misleading URLs.
A standalone Node.js reproduction is linked above. This is a source-level regression, not a confirmed production exploit.
This issue follows the maintainer's request in #16604 to track HTTP 302 Location validation separately from Managed OAuth 401 handling.
Please provide any relevant error logs
No response
- Dominant language
- TypeScript
- Stars
- 4.7k
- Forks
- 1.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 257
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cloudflare/workers-sdk
-
bug feature:local-explorer
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
cloudflare/workers-sdk#16763 · 1 comment ·
Maintainers usually reply within 1 day
-
wrangler preview: require an explicit previews block only when needed (empty {} should be implied)Openpackage:wrangler product:previews
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
cloudflare/workers-sdk#16754 · 1 comment ·
Maintainers usually reply within 1 day
-
bug feature:workers-assets package:deploy-helpers package:wrangler
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
cloudflare/workers-sdk#16713 · 1 comment ·
Maintainers usually reply within 1 day
-
bug error-messaging package:workers-utils product:containers
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cloudflare/workers-sdk#16692 · 1 comment ·
Maintainers usually reply within 1 day
-
bug package:vite-plugin
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
cloudflare/workers-sdk#16605 · 2 comments ·
Maintainers usually reply within 1 day
All issues in cloudflare/workers-sdk
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
binding:python bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
coollabsio/orbit#72 ·
Maintainers usually reply within 1 day
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
Maintainers usually reply within 1 day
-
bug needs-triage potential-regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
aws/aws-sdk-js-v3#8408 ·
Maintainers usually reply within 1 day