Request lifecycle

1. DNS resolves to nearest edge PoP
2. TLS terminates at the edge
3. Edge function executes in-region isolate
4. Function can respond directly or fetch from origin
5. Response cached at edge if cache headers allow

Workflow

Step 1 — Scaffold a Cloudflare Worker

npm create cloudflare@latest my-worker -- --type=hello-world
cd my-worker

Step 2 — Configure wrangler.toml

name = "my-worker"
main = "src/index.ts"
compatibility_date = "2024-12-01"

[vars]
ENVIRONMENT = "production"

[[kv_namespaces]]
binding = "CACHE_KV"
id = "abc123"

Step 3 — Implement the handler

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const url = new URL(request.url);

    // Geo-based routing
    const country = request.cf?.country ?? "US";
    if (country === "DE") {
      return Response.redirect("https://de.example.com" + url.pathname);
    }

    // KV-backed cache
    const cached = await env.CACHE_KV.get(url.pathname);
    if (cached) {
      return new Response(cached, {
        headers: { "Content-Type": "application/json", "X-Cache": "HIT" },
      });
    }

    const origin = await fetch("https://api.example.com" + url.pathname);
    const body = await origin.text();
    await env.CACHE_KV.put(url.pathname, body, { expirationTtl: 300 });

    return new Response(body, {
      headers: { "Content-Type": "application/json", "X-Cache": "MISS" },
    });
  },
};

Step 4 — Vercel Edge Function equivalent

// app/api/geo/route.ts
import { NextRequest, NextResponse } from "next/server";

export const runtime = "edge";

export function GET(request: NextRequest) {
  const country = request.geo?.country ?? "US";
  const city = request.geo?.city ?? "unknown";

  return NextResponse.json({
    country,
    city,
    timestamp: Date.now(),
  });
}

Step 5 — Deploy and verify

# Cloudflare
npx wrangler deploy

# Verify latency from multiple regions
curl -w "time_total: %{time_total}s\n" https://my-worker.example.workers.dev/

Examples

JWT validation at the edge

import { jwtVerify } from "jose";

async function validateToken(request: Request, env: Env): Promise<Response> {
  const auth = request.headers.get("Authorization");
  if (!auth?.startsWith("Bearer ")) {
    return new Response("Unauthorized", { status: 401 });
  }

  try {
    const secret = new TextEncoder().encode(env.JWT_SECRET);
    const { payload } = await jwtVerify(auth.slice(7), secret);
    return new Response(JSON.stringify({ userId: payload.sub }), {
      headers: { "Content-Type": "application/json" },
    });
  } catch {
    return new Response("Invalid token", { status: 403 });
  }
}

A/B testing with edge-side cookies

export default {
  async fetch(request: Request): Promise<Response> {
    const cookie = request.headers.get("Cookie") ?? "";
    let variant = cookie.match(/ab_variant=(\w+)/)?.[1];

    if (!variant) {
      variant = Math.random() < 0.5 ? "control" : "treatment";
    }

    const origin = variant === "treatment"
      ? "https://v2.example.com"
      : "https://example.com";

    const response = await fetch(origin + new URL(request.url).pathname);
    const mutated = new Response(response.body, response);
    mutated.headers.set("Set-Cookie", \`ab_variant=${variant}; Path=/; Max-Age=86400\`);
    return mutated;
  },
};

Decision tree

Need to run code on every request?
├── Yes → Is the logic lightweight (<50ms CPU)?
│   ├── Yes → Edge function ✓
│   └── No  → Serverless function or origin server
└── No  → Static asset or CDN cache

Which edge platform?
├── Need KV, R2, Durable Objects, D1 → Cloudflare Workers
├── Next.js app on Vercel            → Vercel Edge Functions
├── Deno-native codebase             → Deno Deploy
└── Multi-cloud / portable           → Cloudflare Workers (most portable API)

Edge cases and gotchas

• No Node.js APIs: Workers and Vercel Edge run V8, not Node. `fs`, `net`, `child_process` are unavailable. Use Web APIs (`fetch`, `crypto`, `TextEncoder`).
• Cold starts are rare but real: Isolate recycling can add 5–50 ms on first request to a new PoP. Pre-warm critical paths with scheduled pings.
• Subrequest limits: Cloudflare Workers allow 50 subrequests per invocation (1000 on paid). Plan fan-out carefully.
• Global state is unreliable: Variables declared outside the handler may persist between requests on the same isolate, but never depend on it.
• Body size limits: Workers have a 100 MB response body limit; Vercel Edge has stricter limits for streaming.
• Date.now() may be pinned: In some runtimes, `Date.now()` returns the same value for the entire request for security. Use `performance.now()` for elapsed-time measurement.
• Crypto key import is async: `crypto.subtle.importKey` returns a promise. Cache imported keys in module scope.

Evaluation criteria

Research-backed changes

The biggest delta is Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers. Fold the concrete changes into the operating notes, then discard the fluff.

Fresh signals

• Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers · Cloudflare Blog
• Cloudflare Client-Side Security: smarter detection, now open to everyone · Cloudflare Blog
• How we use Abstract Syntax Trees (ASTs) to turn Workflows code into visual diagrams · Cloudflare Blog
• Chrome 147 enables concurrent and nested view transitions with element-scoped view transitions · Chrome Developer Blog

Next edits

• Add one new tactic based on Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers.
• Rewrite one stale section with today's source language.
• Turn the top signal into a reusable agent prompt.