Cloudflare Workers Security

This handles the security fundamentals you need for Cloudflare Workers: JWT and API key authentication, input validation with Zod, rate limiting, CORS configuration, and security headers. It includes working code for verifying tokens with crypto.subtle, hashing API keys, and a practical checklist of the top 10 vulnerabilities like SQL injection, XSS, and secrets exposure. Use it when you're building an API that needs auth, debugging CORS errors, or hardening a worker against common attacks. The templates give you drop-in middleware for auth and rate limiting. Honestly, it's less about novel techniques and more about having the boilerplate done right so you don't ship something with missing headers or weak token validation.

skills.sh installs: 369
GitHub stars: 248
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add secondsky/claude-skills --skill cloudflare-workers-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Cloudflare Workers Security

Comprehensive security patterns for protecting Workers and APIs.

Quick Security Checklist

// 1. Validate all input
const validated = schema.parse(await request.json());

// 2. Authenticate requests
const user = await verifyToken(request.headers.get('Authorization'));
if (!user) return new Response('Unauthorized', { status: 401 });

// 3. Rate limit
const limited = await rateLimiter.check(clientIP);
if (!limited.allowed) return new Response('Too Many Requests', { status: 429 });

// 4. Add security headers
response.headers.set('X-Content-Type-Options', 'nosniff');
response.headers.set('X-Frame-Options', 'DENY');

// 5. Use HTTPS-only cookies
headers.set('Set-Cookie', 'session=xxx; Secure; HttpOnly; SameSite=Strict');