Create custom headers for Cloudflare Access-protected origins with Workers
This tutorial covers how to use a Cloudflare Worker to add custom HTTP headers to traffic, and how to send those custom headers to your origin services protected by Cloudflare Access.
Some applications and networking implementations require specific custom headers to be passed to the origin, which can be difficult to implement for traffic moving through a Zero Trust proxy. You can configure a Worker to send the user authorization headers required by Access.
- Secure your origin server with Cloudflare Access
-
Log in to the Cloudflare dashboard ↗ and select your account. Go to Workers & Pages.
-
If this is your first Worker, select Create Worker. Otherwise, select Create application, then select Create Worker.
-
Enter an identifiable name for the Worker, then select Deploy.
-
Select Edit code.
-
Input the following Worker:
export default { async fetch(request, env, ctx): Promise<Response> { const { headers } = request; const cfaccessemail = headers.get("cf-access-authenticated-user-email");
const requestWithID = new Request(request); requestWithID.headers.set('company-user-id', cfaccessemail);
return fetch(requestWithID); },} satisfies ExportedHandler<Env>;- Select Save and deploy.
Your Worker is now ready to send custom headers to your Access-protected origin services.
- Select the Worker you created, then go to Triggers.
- In Routes, select Add route.
- Enter the hostname and zone for your origin, then select Add route.
The Worker will now insert a custom header into requests that match the defined route. For example:
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding": "gzip", "Accept-Language": "en-US,en;q=0.9", "Cf-Access-Authenticated-User-Email": "user@example.com", "Company-User-Id": "user@example.com", "Connection": "keep-alive"