IP Allow lists suck Secure your staging environments with Cloudflare workers
summary
Argues that IP allow lists suck and replaces them with OpenID Connect + PKCE using Auth0 and Cloudflare Workers, enabling per-user grant/revoke tied to company identity. Implements PKCE flow, stores a hashed session key in Cloudflare KV, sets HTTP-only cookies, and proxies authenticated requests to the origin. Deploys via a GitHub Action. Claims sub-10 ms edge auth checks, uses Cloudflare free tier (100k req/day, KV quotas) and cheap scaling, and shows a working prototype.
AI-written summary · about
chapters (8)
- 0:00The staging dilemma
- 2:44Why staging requires security
- 9:23The failure of IP allow lists
- 16:55Principles of zero trust
- 21:49Implementing OIDC and PKCE
- 29:26Cloudflare Workers platform
- 37:54Coding the security solution
- 50:10Conclusion and Q&A
related talks
32mImplementing Zero Trust
36mAdvanced Authentication patterns at the Edge
23mMoving application auth to the edge
33mFirst-Class Auth Experience In Frontend Applications
27mFrom AuthN to AuthZ: The Future of Identity
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
30mStandards-based authentication for JavaScript sites
56mLock That Sh*t Down!