Cloudflare has updated its Workers platform so that subrequests targeting a BYOIP‑enabled hostname retain the original Workers context. The change means the CF-Worker header and cf.worker.upstream_zone field are now forwarded, and the client IP is presented via CF-Connecting-IP according to zone topology.
What Changed
When a Worker issues a subrequest to a Cloudflare‑proxied domain that uses Bring Your Own IP, the request is now classified as Cloudflare‑to‑Cloudflare traffic. The platform forwards the CF-Worker header and the cf.worker.upstream_zone field to the destination zone. For cross‑zone calls, CF-Connecting-IP is set to the original Worker client IP (e.g., 2a06:98c0:3600::103), while same‑zone calls continue to expose the client IP directly.
Why It Matters
Previously, some BYOIP subrequests lost this context, causing security rules to see an internal Cloudflare connection instead of the true end‑user. Bot Management could mis‑score traffic, and rules that relied on the client IP sometimes returned a 403. Preserving the context restores accurate Bot Management variables, JA3/JA4 fingerprints, and ensures that security policies evaluate the real user request.
Operational and Architectural Implications
- Consistent security evaluation: Rulesets that reference
CF-Workeror upstream zone data will now behave uniformly across zones. - Cross‑zone subrequest handling: Engineers must be aware that
CF-Connecting-IPwill now reflect the original client IP for cross‑zone calls, which may affect logging, rate‑limiting, or analytics pipelines. - Potential impact on existing Workers: Any custom logic that previously compensated for missing headers will need to be revisited to avoid duplicate processing.
- Testing and observability: Updated behavior should be validated in staging environments, especially for services that rely on Bot Management scores or IP‑based access controls.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Review any Workers that perform subrequests to BYOIP domains and confirm they no longer depend on the absence of CF-Worker or upstream zone data. Update logging and monitoring to capture the now‑present client IP in cross‑zone scenarios. Run a quick regression test of security rules and Bot Management thresholds to ensure scores remain within expected ranges. Finally, incorporate this behavior into your deployment checklist so future Workers automatically benefit from the preserved context.
