skills/cloudflare__skills
1
0
Fork 0
mirror of https://github.com/cloudflare/skills.git synced 2026-09-14 16:49:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Clarify verification for Access JWT fallback

Browse Source
This commit is contained in:
Brendan Irvine-Broque
2026-09-05 15:55:32 -07:00
parent 830dde3bcd
commit f4ae762f1c
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/cloudflare-app-auth/SKILL.md
+3 -1
View File
@@ -46,7 +46,9 @@ Read [ctx.access limitations](https://developers.cloudflare.com/workers/configur
## Verify the boundary
Use the [local Access simulation](https://developers.cloudflare.com/workers/configuration/cloudflare-access/#test-ctxaccess-locally) to exercise identity-dependent handlers: configure `access.dev` with an audience and test identity, then remove the development block to exercise missing context. This simulates identity; it does not prove deployed Access policy enforcement.
For handlers that consume native `ctx.access`, use the [local Access simulation](https://developers.cloudflare.com/workers/configuration/cloudflare-access/#test-ctxaccess-locally): configure `access.dev` with an audience and test identity, then remove the development block to exercise missing context. This exercises native-context handling; it does not inject a request JWT, test a JWT fallback, or prove deployed Access policy enforcement.
For a request-token fallback, test the verifier separately using signed test tokens and verifier fixtures: valid claims, invalid signature, wrong issuer or audience, and expired tokens. On the deployed request path, verify token presence and rejection of missing or invalid tokens; this is especially relevant when Static Assets makes native context unavailable.
Test the flows affected by the change: