Sign requests
Verify a signed request using the HMAC and SHA-256 algorithms or return a 403.
You can both verify and generate signed requests from within a Worker using the Web Crypto APIs.
The following Worker will:
-
For request URLs beginning with
/generate/, replace/generate/with/, sign the resulting path with its timestamp, and return the full, signed URL in the response body. -
For all other request URLs, verify the signed URL and allow the request through.
Validate signed requests using the WAF
The provided example code for signing requests is compatible with the is_timed_hmac_valid_v0() Rules language function. This means that you can verify requests signed by the Worker script using a WAF custom rule.