The door

An old network is built like a castle: a moat around it, a drawbridge in, and once you are inside, everyone trusts you. Zero Trust has no inside. Every single request has to show who it is, every time, at the door it wants to go through. wi24rd.com has one door locked that way: the administration at /admin/. It stands in the middle of this page, and you are welcome to knock.

The castle and the door

Knock

The door leads to the site’s administration. You will not get in. That is the whole point.

What happens when you knock

1. The edge. Your request reaches the Cloudflare data centre nearest you. Before the site Worker even wakes up, Cloudflare Access looks at it.
2. The ticket. Access looks for a valid access ticket: a signed JWT in the CF_Authorization cookie. Without one, you are sent on to the site’s login page at Cloudflare. The site’s code never sees you.
3. Who are you? Login uses a method Access trusts, and the policy says exactly who may come in: only the site’s maintainer. It does not matter where you sit or which network you are on.
4. The second lock. If you get past Access, the site’s own code checks the ticket once more: the signature against Cloudflare’s public keys, who issued it and for whom, whether it has expired, and whether the email is on the list of administrators. Should the Access rule ever go missing, or a preview address stand without it, the door is still locked.
5. The trail. Access logs every login. The site only counts how many times the door was tried and what happened, never who.

The door in numbers

Counted every hour from Cloudflare’s GraphQL Analytics API: requests for /admin/ and the status code the edge answered with. No IP addresses, no names – and only weekly totals, so the page does not reveal when the maintainer goes in.

The rest of the Zero Trust family

Access is the part wi24rd.com uses. Cloudflare Zero Trust (Cloudflare One) has more, and there is a free plan for small teams.

How to lock a door yourself

1. Open Zero Trust in the Cloudflare dashboard and create an organisation. Choose the free plan if it is enough.
2. Under Access controls → Applications, choose Add an application → Self-hosted and set the address to, say, example.com/admin.
3. Add an Allow policy that includes only your own email, and choose a login method (a one-time code by email, or GitHub, for example). An application without a policy denies everyone.
4. Let your own code check the ticket again, so a missing rule does not open the door:

// Second lock: the site’s own code checks the Access ticket again (shortened)
const token = request.headers.get('cf-access-jwt-assertion');         // or the CF_Authorization cookie
const [header, body, sig] = token.split('.');
const keys = await fetch(`https://${TEAM}/cdn-cgi/access/certs`);  // Cloudflare’s public keys
// 1. the signature must match one of the keys (RS256)
// 2. aud must be the site’s Access application, iss the site’s team
// 3. the ticket must not have expired (exp)
// 4. the email must be on the list of administrators (ADMIN_EMAILS)
if (!valid) return new Response('For the site’s maintainer only.', { status: 403 });

The same check lives in the open engine: the tingsvad.dk project on GitHub. Raw numbers as JSON: /api/maskine/doeren.

The family: The defences·The crawlers·The speed·Denmark right now·The archive cabinet·The door·The infrastructure map·The audit·Back to the machine room