Cloudflare

Edge-based session management using KV for session storage. Worker intercepts requests, validates session cookies against KV entries, and attaches user context to downstream requests. Sessions are created on authentication, stored as JSON in KV with a TTL matching session expiry, and invalidated by deleting the KV entry on logout. Cookie attributes enforce Secure, HttpOnly, and SameSite=Lax for security.

// Worker flow:
// 1. Extract session ID from cookie
// 2. Fetch session data from KV (sub-ms read)
// 3. If valid: attach user context headers, forward to origin
// 4. If expired/missing: redirect to auth flow
// 5. On login: generate session ID, store in KV with TTL
// 6. On logout: delete KV entry, clear cookie
//
// KV entry: { userId, roles, expiresAt, lastAccess }
// TTL: 24 hours (sliding window via KV metadata update)

Secure file upload/download flow using Workers to generate presigned URLs for direct R2 access. Upload flow: client requests presigned PUT URL from Worker (which validates auth and constructs the URL), then uploads directly to R2 — no proxy through Workers for large files. Download flow: Worker generates presigned GET URL with short TTL. Custom metadata (original filename, content type, uploader ID) stored alongside the object.

// Upload flow:
// Client ──POST /api/upload-url──> Worker
//   Worker: validate JWT, generate presigned PUT URL
// Client ──PUT (presigned URL)───> R2 (direct, no proxy)
//   R2: store object with custom metadata
//
// Download flow:
// Client ──GET /api/download/id──> Worker
//   Worker: validate access, generate presigned GET URL (5min TTL)
// Client ──GET (presigned URL)───> R2 → CDN (cached at edge)

Real-time collaboration pattern using Durable Objects for WebSocket state coordination. Each collaboration room maps to one Durable Object instance. The DO maintains a list of connected WebSockets, handles message broadcasting, manages room state in transactional storage, and provides conflict resolution for concurrent edits. Workers route incoming WebSocket connections to the correct DO based on room ID in the URL.

// Connection flow:
// Client ──WebSocket──> Worker (edge)
//   Worker: extract roomId, forward to Durable Object
//   DO: accept WebSocket, add to connections set
//   DO: broadcast join event to existing connections
//
// Message flow:
// Client ──message──> DO
//   DO: validate, apply to room state (transactional storage)
//   DO: broadcast to all other connections
//   DO: acknowledge to sender
//
// Disconnect: remove from set, broadcast leave event