Workers, R2, D1 & the Edge Platform

Workers — Edge Compute

export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    if (url.pathname === '/api/hello') {
      return new Response('Hello from the edge!', { status: 200 });
    }
    return fetch(request); // pass through to origin
  },
};

Workers run in a V8-isolate runtime (not full containers/VMs) — near-zero cold start, well suited for request-path logic (auth checks, redirects, A/B testing) running before the request reaches the origin. Not full Node.js: implements web-standard APIs (fetch, Request/Response) in an isolate, so some Node-specific APIs/native modules may need adaptation.

Storage: R2, KV, D1, Durable Objects

R2 — S3-compatible object storage, no egress fees (a deliberate competitive stance vs. S3). D1 — serverless SQL (SQLite-based) for use from Workers. KV — globally-distributed, eventually-consistent key-value store, great for infrequently-changing data (config, cached content), not for data needing strong read-after-write consistency.

// KV — fast, eventually-consistent reads
const config = await env.MY_KV.get('feature-flags', { type: 'json' });

// D1 — SQL from the edge
const { results } = await env.DB.prepare(
  'SELECT * FROM users WHERE id = ?'
).bind(userId).all();

Durable Objects

A strongly-consistent, single-instance stateful Worker variant — pinned to one location, useful for real-time collaboration, chat rooms, or rate limiting where a single source of truth for a piece of state is required, unlike KV's replicated/eventual model.

Cloudflare Access (Zero Trust)

Identity-aware access control gating who can reach an internal app based on identity-provider login and device posture — often replacing a traditional VPN, reflecting the Zero Trust model of verifying every request rather than trusting anything inside a network perimeter.

Caching Personalized Responses

Caching a dynamic, per-user API response without a cache key accounting for auth/user context can leak one user's data to another — a general shared-cache risk, not unique to Cloudflare. Vary cache by cookie/header, or bypass caching for personalized responses.