search

ostark / upper

Integrates Edge Caches like Fastly, KeyCDN, Cloudflare and Varnish with Craft.
MIT License
102 stars 22 forks source link

[FR] Update Cloudflare driver to use scoped tokens #38

Closed tomdavies closed 4 years ago

tomdavies commented 4 years ago

The CloudFlare driver currently requires the user to use their account level API key, a key which if compromised gives an attacker complete control over their CloudFlare account. Needless to say this is somewhat less than ideal.

As of August 2019 CloudFlare allows the creation of scoped tokens than just have the privileges required to clear caches in a zone / domain:

Screenshot 2020-04-09 09 26 26

This is then just passed in a Authorization: Bearer <token> header on the CF request in place of the X-Auth-Key / X-Auth-Email headers.

I appreciate this would be a breaking change for CF users, but it's much more secure, so still seems like a good idea. Perhaps we could support both for now with a deprecation warning for users of X-Auth-Key?

Happy to take a stab at a PR if it would be welcome and/or you don't have time @ostark

ostark commented 4 years ago

It makes sense to support both, otherwise, a major version bump would be required. @tomdavies PR?

tomdavies commented 4 years ago

Cool, will hop on it this weekend

ostark commented 4 years ago

Sorry for the late release https://github.com/ostark/upper/releases/tag/1.6.0