Follow
a request.

When the Worker runs, it can cache from its own code in two ways. A fetch() subrequest goes through the zone’s cache, including tiered cache. The Cache API, caches.default, is local to one data center and does not use tiered cache, so another data center will not find what this one stored.

Before HTTP

A proxied record answers with Cloudflare anycast addresses, so the browser connects to Cloudflare’s network. A DNS-only record answers with the origin’s own address, and none of Cloudflare’s checks or caching apply. The lookup sees no URL path, cookie or header.

The front door

DDoS protection mitigates floods of traffic; the WAF checks each HTTP request against rules and can allow, block or challenge it. A request that passes is not a signed-in user: your Worker still checks the session, the permission and the input.

Static Assets, unless you say otherwise

A path that matches a deployed file gets the file without invoking the Worker; a path that matches nothing goes to the Worker. run_worker_first takes true or a list of patterns, and a pattern starting with ! excludes paths. Assets are cached and tiered across Cloudflare’s network.

"assets": {
  "directory": "./public",
  "run_worker_first": ["/api/*", "!/api/docs/*"]
}

Workers Cache

With "cache": { "enabled": true }, Cloudflare answers a matching request from the cache without running the Worker. Your code decides with Cache-Control, followed as RFC 9111 defines it. Only GET and HEAD are cached; a POST always runs the Worker.

Isolates and bindings

A Worker runs in a V8 isolate that is reused across requests and can be evicted at any time, so a global variable is not state. A binding names one resource in configuration, and code without that binding cannot reach it.

// wrangler.jsonc: "d1_databases": [{ "binding": "DB", … }]
export default {
  async fetch(request, env) {
    await env.DB.prepare("INSERT INTO photos (title) VALUES (?)")
      .bind(title)
      .run();
    return Response.json({ saved: true }, { status: 201 });
  },
};