Cloudflare Worker wildcard route silently blocks R2 custom domain, returns 404

·1 views

A developer spent nearly a full day debugging persistent 404 errors on a Cloudflare R2 bucket served via a custom subdomain, despite all components appearing healthy in their respective dashboards. The root cause was a previously configured Cloudflare Worker with a wildcard route pattern covering all subdomains, which intercepted requests before they could reach R2. Because Cloudflare evaluates Worker routes independently of R2 custom domain settings, neither dashboard flagged the conflict. The fix was straightforward: replacing the wildcard route with explicit hostname patterns limited to the subdomains the Worker was actually meant to serve. The developer warns that this silent conflict can affect any new subdomain added to an account already running a Worker with a broad wildcard route.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Cloud Attack Paths Hidden in Resource Relationships, Not Individual Misconfigs

Most cloud security tools scan individual resources for known vulnerabilities, but the most dangerous attack paths emerge from relationships between resources rather than any single misconfiguration. A chain of individually valid permissions — such as updating an IAM role, passing it to a Lambda function, and deleting S3 objects — can create an unintended privilege escalation path that no single-resource scanner would flag. Structural analysis techniques like Datalog-based graph traversal can detect these transitive permission chains without requiring any user-defined metadata or intent declarations. Similarly, SMT solvers such as Z3 can evaluate complex policy conditions mathematically to determine whether they effectively grant wildcard access, even when no explicit wildcard was written. Circular role trust and self-modifying permission paths are also structurally detectable risks that the security industry has largely overlooked in favor of property-based resource checks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a 60-line Doctrine type adds column-level encryption to a Symfony app

A developer building InvoicePilot, a Shopify invoicing app, found the application stored customer names, addresses and emails in plain text in a PostgreSQL database on an unencrypted VPS. To honestly answer a compliance audit question about data-at-rest encryption, they implemented application-level column encryption using PHP's built-in libsodium library in roughly 60 lines of code via a custom Doctrine type. The approach targets realistic, lower-cost threats such as leaked database dumps, misconfigured backup storage, and contractor access to restored snapshots, rather than full host compromises. However, the author notes that once a database column becomes an encrypted blob, four previously reliable features — including some that fail silently — stop working as expected. The post also warns that the entire approach is undermined if the encryption key is stored alongside the data it protects.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AI Agents Differ From Traditional Software and Why the Shift Matters

AI agents represent a significant departure from conventional rule-based software, which executes predefined instructions in response to fixed inputs. Unlike traditional applications, AI agents can interpret goals, plan multi-step tasks, make decisions, and use external tools such as web search, APIs, and databases to complete work autonomously. Four core capabilities — reasoning, memory, tool use, and planning — enable these systems to handle complex, open-ended requests without hardcoded logic. Large language models alone are insufficient for this, as they can generate inaccurate information and lack access to private or real-time data. To address these gaps, modern AI applications combine LLMs with techniques like Retrieval-Augmented Generation, which grounds responses in relevant external information.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

S3-Compatible Object Storage: What It Means and How to Choose in 2026

S3 compatibility refers to implementing Amazon's S3 REST API as a protocol, not using AWS itself, with any system supporting seven core operations and Signature V4 authentication considered broadly compatible. Amazon's early 2006 launch gave S3 a first-mover advantage, and the resulting SDK ecosystem made its API the de facto standard for object storage across the industry. Compatibility exists on a spectrum — core read/write operations are reliable across providers, but advanced features like event notifications or Glacier tiering are rarely replicated. Self-hosted options such as RustFS, MinIO, Ceph, and SeaweedFS vary in scale, licensing, and API coverage, catering to workloads from single-node setups to exabyte-scale deployments. Choosing the right implementation depends on factors like cloud versus self-hosted preference, data scale, and license constraints rather than product reputation alone.

0 comments Read more at DEV Community