Protecting a personal web app with Cloudflare Access and email OTP

This article explains how to protect a personal web application running on Cloudflare Workers using Cloudflare Access and email one-time-password (OTP) authentication. The author deployed a task management app to Cloudflare Workers but wanted to prevent anyone with the URL from accessing it without authentication. Cloudflare Access provides a solution that can be enabled with minimal changes to the application code. The setup process involves three main steps:

1. Enable Access on the workers.dev URL: In the Cloudflare dashboard, select the Worker, go to Domains & Routes, and choose the option to protect the workers.dev URL with Access. This will require visitors to sign in and match the Access policy before the Worker loads.

2. Allow only your email address: In the Cloudflare Access management screen, restrict the policy to your own email address. When the URL is opened, Access redirects to its sign-in page, where entering the email address triggers a six-digit one-time code. Entering the code finally grants access to the application.

3. Close the preview URL: The dashboard also includes a preview URL (workers.dev), which should be protected with Access as well to prevent it from exposing the latest deployment. Disabling or protecting the preview URL ensures that only the main URL is accessible after authentication.

Additional considerations include:

- The Free plan of Cloudflare Access covers up to 50 users at no charge, with no additional cost. The session duration can be extended up to one month to avoid entering the code daily.

- Access authentication applies to both HTML, JavaScript, and API routes, ensuring comprehensive protection. However, if sensitive data is involved, the dashboard warns that Workers handling such data should validate the Access JWT and reject bypass requests.

- While this setup effectively protects a personal app without requiring custom domain configuration or extensive infrastructure work, it should be noted that Access authentication relies on the entry route configuration. If additional routes are exposed, validating the Access JWT inside the Worker adds an extra layer of security.

Overall, this setup provides a convenient and efficient way to secure a personal web application on Cloudflare Workers without the need for separate login implementations or password storage.