{"id":107794,"date":"2023-01-18T09:32:29","date_gmt":"2023-01-18T17:32:29","guid":{"rendered":"https:\/\/www.backblaze.com\/blog\/?p=107794"},"modified":"2023-07-11T09:59:03","modified_gmt":"2023-07-11T16:59:03","slug":"how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker","status":"publish","type":"post","link":"https:\/\/www.backblaze.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/","title":{"rendered":"How to Serve Data From a Private Bucket with a Cloudflare Worker"},"content":{"rendered":"

\"Backblaze<\/p>\n

Customers storing data in Backblaze B2 Cloud Storage<\/a> enjoy zero-cost downloads via our Content Delivery Network (CDN) partners: Cloudflare, Fastly, and Bunny.net. Configuring a CDN to proxy access to a Backblaze B2 Bucket is straightforward and improves the user experience, since the CDN caches data close to end-users. Ensuring that end-users can only<\/em> access content via the CDN, and not directly from the bucket, requires a little more effort. A new technical article, Cloudflare Workers for Backblaze B2<\/a>, provides the steps to serve content from Backblaze B2 via your own Cloudflare Worker.<\/p>\n

In this blog post, I\u2019ll explain why you might want to prevent direct downloads from your Backblaze B2 Bucket, and how you can use a Cloudflare Worker<\/a> to do so.<\/p>\n

Why Prevent Direct Downloads?<\/h2>\n

As mentioned above, Backblaze\u2019s partnerships with CDN providers<\/a> allow our customers to deliver content to end users with zero costs for data egress from Backblaze to the CDN. To illustrate why you might want to serve data to your end users exclusively through the CDN, let\u2019s imagine you\u2019re creating a website, storing your website\u2019s images in a Backblaze B2 Bucket with public-read access, acme-images<\/code>.<\/p>\n

For the initial version, you build web pages with direct links to the images of the form https:\/\/acme-images.s3.us-west-001.backblazeb2.com\/logos\/acme.png<\/code>. As users browse your site, their browsers will download images directly from Backblaze B2. Everything works just fine for users near the Backblaze data center hosting your bucket, but the further a user is from that data center, the longer it will take each image to appear on screen. No matter how fast the network connection, there\u2019s no getting around the speed of light!<\/p>\n

Aside from the degraded user experience, there are costs<\/a> associated with end users downloading data directly from Backblaze. The first GB of data downloaded each day is free, then we charge $0.01 for each subsequent GB. Depending on your provider\u2019s pricing plan, adding a CDN to your architecture can both reduce download costs and<\/em> improve the user experience, as the CDN will transfer data through its own network and cache content close to end users. Another detail to note when comparing costs is that Backblaze and Cloudflare\u2019s Bandwidth Alliance<\/a> means that data flows from Backblaze to Cloudflare free of download charges, unlike data flowing from, for example, Amazon S3 to Cloudflare.<\/p>\n

Typically, you need to set up a custom domain, say images.acme.com<\/code>, that resolves to an IP address at the CDN. You then configure one or more origin servers or backends at the CDN with your Backblaze B2 Buckets\u2019 S3 endpoints. In this example, we\u2019ll use a single bucket, with endpoint acme-images.s3.us-west-001.backblazeb2.com<\/code>, but you might use Cloud Replication<\/a> to replicate content between buckets in multiple regions for greater resilience.<\/p>\n

Now, after you update the image links in your web pages to the form https:\/\/images.acme.com\/logos\/acme.png<\/code>, your users will enjoy an improved experience, and your operating costs will be reduced.<\/p>\n

As you might have guessed, however, there is one chink in the armor. Clients can<\/em> still download images directly from the Backblaze B2 Bucket, incurring charges on your Backblaze account. For example, users might have bookmarked or shared links to images in the bucket, or browsers or web crawlers might have cached those links.<\/p>\n

The solution is to make the bucket private and create an edge function: a small piece of code running on the CDN infrastructure at the images.acme.com<\/code> endpoint, with the ability to securely access the bucket.<\/p>\n

Both Cloudflare and Fastly offer edge computing platforms; in this blog post, I\u2019ll focus on Cloudflare Workers and cover Fastly Compute@Edge at a later date.<\/p>\n

Proxying Backblaze B2 Downloads With a Cloudflare Worker<\/h2>\n

The blog post Use a Cloudflare Worker to Send Notifications on Backblaze B2 Events<\/a> provides a brief introduction to Cloudflare Workers; here I\u2019ll focus on how the Worker accesses the Backblaze B2 Bucket.<\/p>\n

API clients, such as Workers, downloading data from a private Backblaze B2 Bucket via the Backblaze S3 Compatible API must digitally sign each request with a Backblaze Application Key ID (access key ID in AWS parlance) and Application Key (secret access key). On receiving a signed request, the Backblaze B2 service verifies the identity of the sender (authentication) and that the request was not changed in transit (integrity) before returning the requested data.<\/p>\n

So when the Worker receives an unsigned HTTP request from an end user\u2019s browser, it must sign it, forward it to Backblaze B2, and return the response to the browser. Here are the steps in more detail:<\/p>\n

    \n
  1. A user views a web page in their browser.<\/li>\n
  2. The user\u2019s browser requests an image from the Cloudflare Worker.<\/li>\n
  3. The Worker makes a copy of the incoming request, changing the target host in the copy to the bucket endpoint, and signs the copy with its application key and key ID.<\/li>\n
  4. The Worker sends the signed request to Backblaze B2.<\/li>\n
  5. Backblaze B2 validates the signature, and processes the request.<\/li>\n
  6. Backblaze B2 returns the image to the Worker.<\/li>\n
  7. The Worker forwards the image to the user\u2019s browser.<\/li>\n<\/ol>\n

    These steps are illustrated in the diagram below.<\/p>\n

    \"diagram<\/p>\n

    The signing process imposes minimal overhead, since GET requests have no payload. The Worker need not even read the incoming response payload into memory, instead returning the response from Backblaze B2 to the Cloudflare Workers framework to be streamed directly to the user\u2019s browser.<\/p>\n

    Now you understand the use case, head over to our newly published technical article, Cloudflare Workers for Backblaze B2<\/a>, and follow the steps to serve content from Backblaze B2 via your own Cloudflare Worker.<\/p>\n

    Put the Proxy to Work!<\/h2>\n

    The Cloudflare Worker for Backblaze B2<\/a> can be used as-is to ensure that clients download files from one or more Backblaze B2 Buckets via Cloudflare, rather than directly from Backblaze B2. At the same time, it can be readily adapted for different requirements. For example, the Worker could verify that clients pass a shared secret in an HTTP header, or route requests to buckets in different data centers depending on the location of the edge server. The possibilities are endless.<\/p>\n

    How will you put the Cloudflare Worker for Backblaze B2 to work? Sign up for a Backblaze B2 account<\/a> and get started!<\/p>\n","protected":false},"excerpt":{"rendered":"

    Backblaze partners with CDN providers to offer free egress between our services. Here’s how\u2014and why\u2014you’d use a Cloudflare Worker to prevent direct downloads of content from your Backblaze B2 Bucket.<\/p>\n","protected":false},"author":174,"featured_media":107802,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[481,7,483],"tags":[468],"class_list":["post-107794","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cdn","category-cloud-storage","category-tech-lab","tag-b2cloud","entry"],"acf":[],"yoast_head":"\nHow to Serve Data From a Private Bucket with a Cloudflare Worker<\/title>\n<meta name=\"description\" content=\"The Cloudflare Worker for Backblaze B2 can be used as-is to ensure that clients download files from Backblaze B2 Buckets via Cloudflare.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.backblaze.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Serve Data From a Private Bucket with a Cloudflare Worker\" \/>\n<meta property=\"og:description\" content=\"The Cloudflare Worker for Backblaze B2 can be used as-is to ensure that clients download files from Backblaze B2 Buckets via Cloudflare.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/\" \/>\n<meta property=\"og:site_name\" content=\"Backblaze Blog | Cloud Storage & Cloud Backup\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/backblaze\" \/>\n<meta property=\"article:published_time\" content=\"2023-01-18T17:32:29+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-11T16:59:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/01\/bb-bh-Cloudflare-B2-Worker_Design-A-e1673990662375.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1440\" \/>\n\t<meta property=\"og:image:height\" content=\"820\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Pat Patterson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@backblaze\" \/>\n<meta name=\"twitter:site\" content=\"@backblaze\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pat Patterson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Serve Data From a Private Bucket with a Cloudflare Worker","description":"The Cloudflare Worker for Backblaze B2 can be used as-is to ensure that clients download files from Backblaze B2 Buckets via Cloudflare.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.backblaze.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/","og_locale":"en_US","og_type":"article","og_title":"How to Serve Data From a Private Bucket with a Cloudflare Worker","og_description":"The Cloudflare Worker for Backblaze B2 can be used as-is to ensure that clients download files from Backblaze B2 Buckets via Cloudflare.","og_url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/","og_site_name":"Backblaze Blog | Cloud Storage & Cloud Backup","article_publisher":"https:\/\/www.facebook.com\/backblaze","article_published_time":"2023-01-18T17:32:29+00:00","article_modified_time":"2023-07-11T16:59:03+00:00","og_image":[{"width":1440,"height":820,"url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/01\/bb-bh-Cloudflare-B2-Worker_Design-A-e1673990662375.png","type":"image\/png"}],"author":"Pat Patterson","twitter_card":"summary_large_image","twitter_creator":"@backblaze","twitter_site":"@backblaze","twitter_misc":{"Written by":"Pat Patterson","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/#article","isPartOf":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/"},"author":{"name":"Pat Patterson","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/person\/a724a8aee97b6451107442747cd101a4"},"headline":"How to Serve Data From a Private Bucket with a Cloudflare Worker","datePublished":"2023-01-18T17:32:29+00:00","dateModified":"2023-07-11T16:59:03+00:00","mainEntityOfPage":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/"},"wordCount":1045,"commentCount":0,"publisher":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#organization"},"image":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/#primaryimage"},"thumbnailUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/01\/bb-bh-Cloudflare-B2-Worker_Design-A-e1673990662375.png","keywords":["B2Cloud"],"articleSection":["CDN","Cloud Storage","Tech Lab"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/","name":"How to Serve Data From a Private Bucket with a Cloudflare Worker","isPartOf":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/#primaryimage"},"image":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/#primaryimage"},"thumbnailUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/01\/bb-bh-Cloudflare-B2-Worker_Design-A-e1673990662375.png","datePublished":"2023-01-18T17:32:29+00:00","dateModified":"2023-07-11T16:59:03+00:00","description":"The Cloudflare Worker for Backblaze B2 can be used as-is to ensure that clients download files from Backblaze B2 Buckets via Cloudflare.","breadcrumb":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/#primaryimage","url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/01\/bb-bh-Cloudflare-B2-Worker_Design-A-e1673990662375.png","contentUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/01\/bb-bh-Cloudflare-B2-Worker_Design-A-e1673990662375.png","width":1440,"height":820,"caption":"Backblaze + Cloudflare logos sending data to a user on a phone"},{"@type":"BreadcrumbList","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-serve-data-from-a-private-bucket-with-a-cloudflare-worker\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Serve Data From a Private Bucket with a Cloudflare Worker"}]},{"@type":"WebSite","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#website","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/","name":"Backblaze Cloud Solutions Blog","description":"Cloud Storage & Cloud Backup","publisher":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#organization","name":"Backblaze","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/www.backblaze.com\/blog\/wp-content\/uploads\/2017\/12\/backblaze_icon_transparent.png?fit=512%2C512&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.backblaze.com\/blog\/wp-content\/uploads\/2017\/12\/backblaze_icon_transparent.png?fit=512%2C512&ssl=1","width":512,"height":512,"caption":"Backblaze"},"image":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/backblaze","https:\/\/x.com\/backblaze","https:\/\/www.youtube.com\/user\/Backblaze","https:\/\/en.wikipedia.org\/wiki\/Backblaze"]},{"@type":"Person","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/person\/a724a8aee97b6451107442747cd101a4","name":"Pat Patterson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2022\/01\/PatPatterson1920px-150x150.png","url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2022\/01\/PatPatterson1920px-150x150.png","contentUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2022\/01\/PatPatterson1920px-150x150.png","caption":"Pat Patterson"},"description":"Pat Patterson is the former chief technical evangelist at Backblaze. Over his three decades in the industry, Pat has built software and communities at Sun Microsystems, Salesforce, StreamSets, and Citrix. In his role at Backblaze, he creates and delivers content tailored to the needs of the hands-on technical professional, acts as the \u201cvoice of the developer\u201d on the Product team, and actively participates in the wider technical community. Outside the office, Pat runs far, having completed ultramarathons up to the 50 mile distance. Catch up with Pat via Bluesky or LinkedIn.","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/author\/pat\/"}]}},"jetpack_featured_media_url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/01\/bb-bh-Cloudflare-B2-Worker_Design-A-e1673990662375.png","_links":{"self":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/posts\/107794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/users\/174"}],"replies":[{"embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/comments?post=107794"}],"version-history":[{"count":0,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/posts\/107794\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/media\/107802"}],"wp:attachment":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/media?parent=107794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/categories?post=107794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/tags?post=107794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}