Item — HN Reader

I think the most important part about the post is at the very end:

> Please don’t take us seriously

> This is an example of all the things you can do with Cloudflare Workes and our API. If you like it, please spread the word! But hey, don’t take us seriously. We just wanted to take the drama out from all the GDPR madness out there.

Anyway: just for academic interest I’m curious how much this increases the overall request latency, as there would be one additional blocking HTTP call at the beginning. Do you have any benchmarks for that API call to check the blacklist?

1 comments

You can see the average latency here: https://status.apility.io

But Cloudflare has servers very close to our endpoints around the world, so I guess < 50ms if you don't use SSL could be a good estimation.

We are working hard to reduce the amount of time to establish the connection. It's about 80% of the time of the request.

If you make sure that the response is cacheable, then Cloudflare will cache it at the edge and so only the first check for any particular IP will be slow.

What makes a response cacheable is a little complicated. There's cache headers, but also some heuristics involved. However, you can override all of that from a Worker by passing an explicit cache TTL to fetch():

    fetch(url, {cf: {cacheTtl: 86400}})

This will force Cloudflare to cache the response at the edge for one day regardless of anything else. (Note: The documentation currently claims this option is available to enterprise customers only, but as of this week, it actually works for everyone. Docs to be updated soon.)

Yes, you should cache as much as you can to reduce the latency. We have some examples using NGINX and Lua to cache at the very edge and reduce roundtrips to our endpoints.

Probably I will give it a try on Workers another Friday afternoon.

Isn't there a Cloudflare geo-location header that you can trivially activate and map to EU/Non-EU? That would result in no additional latency except for the worker itself.

Cloudflare has a country header. So yes, an easy way to block millions of users is checking that header against the list of countries applying GDPR.