Cloudflare Workers Safe & Unsafe Practices
Cloudflare Workers should read credentials from secret bindings set with wrangler secret put, never from plaintext vars in wrangler config. Keep handlers stateless between requests, use the Web Crypto API, and use ctx.waitUntil for background work.
Credentials & Where They Belong
Encrypted and set with wrangler secret put or the dashboard.
Plaintext in source control. Use only for non-sensitive settings.
Safe Practices
Use secret bindings for credentials
Secrets are encrypted at rest and hidden in the dashboard after creation.
Keep request state out of module scope
Isolates are reused across requests, so global mutable state can leak data between users.
Use .dev.vars locally and gitignore it
Local secrets stay off the repository.
Unsafe Practices
Putting secrets in vars in wrangler.jsonc
They are committed to git and visible to anyone with repo access.
Caching per-user data in global variables
Another request on the same isolate can read it.
Logging headers or bodies that contain tokens
Workers Logs and tail sessions would retain the secrets.
RealComposer runs every pipeline on Workers, decrypting vault secrets in memory per request with AES-256-GCM and never persisting them in global state or logs.
Frequently Asked Questions
Q:What is the difference between vars and secrets in Workers?
Vars are plaintext configuration in your wrangler file. Secrets are encrypted bindings that never appear in source control.
Related Concepts
A V8 isolate is a lightweight, sandboxed instance of the V8 JavaScript engine with its own memory heap. Edge platforms like Cloudflare Workers run each script in an isolate instead of a container, so code starts in under five milliseconds and thousands of isolates share one process securely.
Edge FunctionsEdge functions are serverless code that executes in data centers distributed worldwide, physically close to end users, rather than in one central cloud region. They intercept HTTP requests to run logic like authentication, routing, caching, and response transformation with minimal latency.
Encryption at RestEncryption at rest is protecting stored data by encrypting it on disk or in a database, so it is unreadable without the decryption key. For secret vaults, each API key is encrypted with strong algorithms like AES-256-GCM and decrypted only at the moment it is needed.