View Source CloudflareAccessEx (cloudflare_access_ex v0.1.2)
This library aims to simplify the process of sitting an application behind Cloudflare Access.
By default, this library starts its own supervision tree. The root application will read Application config to determine which Cloudflare Access domains to retrieve JWKs from. These keys can then be used to verify the application tokens sent by Cloudflare Access when your application is accessed.
The Cloudflare docs provide more information.
The library also provides a Plug (see CloudflareAccessEx.Plug
) that can be used to to extract and
verify tokens from requests.
Usage:
Add
cloudflare_access_ex
to your list of dependencies inmix.exs
. Note that the:runtime
option can be used to disable Jwks polling in selected environments (i.e.:test
and:dev
)def deps do [ {:cloudflare_access_ex, "~> 0.1", runtime: Mix.env() not in [:test, :dev]} ] end
If you wish to startup the application manually, you can opt out of the runtime dependency and start the supervisor manually:
def deps do [ {:cloudflare_access_ex, "~> 0.1", runtime: false} ] end
in your application module:
CloudflareAccessEx.Supervisor.start_link(... TODO ...)
Get the audience tag from the Cloudflare Access dashboard for your application. Instruction here.
Configure the application:
config :cloudflare_access_ex, :my_cfa_app, domain: "example.cloudflareaccess.com" # this is the audience tag retrieved on step 2 audience: "a8d3b7..."
Multiple applications can be configured by adding more keys to the
:cloudflare_access_ex
config. i.e.config :cloudflare_access_ex, :my_cfa_app, domain: "example.cloudflareaccess.com" audience: "a8d3b7..." config :cloudflare_access_ex, :my_other_cfa_app, domain: "example.cloudflareaccess.com" audience: "7309b8..."
There will only be one process that fetches Jwks keys for each domain. It's also possible to consolidate the duplicate configuration for the domain string like so:
config :cloudflare_access_ex, :example, domain: "example.cloudflareaccess.com" config :cloudflare_access_ex, :my_cfa_app, domain: :example, audience: "a8d3b7..." config :cloudflare_access_ex, :my_other_cfa_app, domain: :example, audience: "7309b8..."
Verify tokens either using
CloudflareAccessEx.Plug
(this will return 401 for invalid tokens by default):plug CloudflareAccessEx.Plug, cfa_app: :my_cfa_app
or using
CloudflareAccessEx.ApplicationTokenVerifier
directly if you need even more control:alias CloudflareAccessEx.{ApplicationTokenVerifier, Principal} verifier = ApplicationTokenVerifier.create(:my_cfa_app) {:ok, principal} = conn |> ApplicationTokenVerifier.verify(verifier) case principal do %Principal{type: :anonymous} -> # do something %Principal{type: :authenticated, user_id: _, email: _}} -> # do something else end