--- title: "The thing’s door · Tingsvad" description: "The thing’s door: Cloudflare Zero Trust explained with a real door. Knock on the administration and see what Access does before the code wakes." url: "https://tingsvad.dk/en/machine-room/the-door/" lang: "en" alternates: da: "https://tingsvad.dk/maskinrummet/doeren/" en: "https://tingsvad.dk/en/machine-room/the-door/" --- # The thing’s door Nobody gets in on a trustworthy face. An old network is built like a castle: a moat around it, a drawbridge in, and once you are inside, everyone trusts you. Zero Trust has no inside. Every single request has to show who it is, every time, at the door it wants to go through. The thing has one door locked that way: the administration. It stands in the middle of this page, and you are welcome to knock. ## The castle and the door ### The castle Firewall and VPN around everything. Inside, you are trusted, and that is exactly the problem: one stolen VPN login or one infected laptop, and the attacker walks freely from room to room. The bigger the castle, the more windows stand ajar. ### The door Zero Trust checks at every single door, close to what it protects. Who are you, is your access still valid, and may you in particular come in here in particular? The answer counts for this request only. Next time, it asks again. Cloudflare calls it _never trust, always verify_. ## Knock The door leads to the thing’s administration, where the guestbook, the raven post and the newspaper are run. You will not get in. That is the whole point. [Knock on the thing’s door (the administration, login via Cloudflare Access required)](https://tingsvad.dk/admin/) For the chieftain only · locked with Cloudflare Access ## What happens when you knock 1. **The edge.** Your request reaches the Cloudflare data centre nearest you. Before the thing’s Worker even wakes up, Cloudflare Access looks at it. 2. **The ticket.** Access looks for a valid access ticket: a signed JWT in the `CF_Authorization` cookie. Without one, you are sent on to the thing’s login page at Cloudflare. The thing’s code never sees you. 3. **Who are you?** Login uses a method Access trusts, and the policy says exactly who may come in: only the thing’s administrator. It does not matter where you sit or which network you are on. 4. **The second lock.** If you get past Access, the thing’s own code checks the ticket once more: the signature against Cloudflare’s public keys, who issued it and for whom, whether it has expired, and whether the email is on the list of administrators. Should the Access rule ever go missing, or a preview address stand without it, the door is still locked. 5. **The trail.** Access logs every login. The thing only counts how many times the door was tried and what happened, never who. ## The door in numbers Updated hourly from Cloudflare’s GraphQL Analytics API: requests for `/admin/` and the status code the edge answered with. No IP addresses, no names – and only weekly totals, so the page does not reveal when the administrator goes in. ## The rest of the Zero Trust family Access is the part the thing uses. Cloudflare Zero Trust (Cloudflare One) has more, and there is a free plan for small teams. In use here ### Access Puts login and policy in front of a website or an application, without a VPN. It is the lock on the thing’s door. Connect ### Tunnel Connects a server behind a firewall to Cloudflare from the inside out, with no open ports. The server has no public address to attack. Filter ### Gateway Filters employees’ DNS and web traffic out to the internet, against phishing and malware for example, wherever they sit. The device ### Cloudflare One Client The app on the computer (formerly WARP). Sends traffic through Cloudflare and reports whether the device is updated and encrypted, so a policy can require it. Isolate ### Browser Isolation Opens risky pages in a browser at Cloudflare and only shows the result. Harmful code never reaches the computer. Data ### CASB and DLP An overview of SaaS applications and rules for which data may not leave the house. ## How to lock a door yourself 1. Open **Zero Trust** in the Cloudflare dashboard and create an organisation. Choose the free plan if it is enough. 2. Under **Access controls → Applications**, choose **Add an application → Self-hosted** and set the address to, say, `example.com/admin`. 3. Add an **Allow** policy that includes only your own email, and choose a login method (a one-time code by email, or GitHub, for example). An application without a policy denies everyone. 4. Let your own code check the ticket again, so a missing rule does not open the door: ``` // Second lock: the thing’s own code checks the Access ticket again (functions/_lib/access.js, shortened) const token = request.headers.get('cf-access-jwt-assertion'); // or the CF_Authorization cookie const [header, body, sig] = token.split('.'); const keys = await fetch(`https://${TEAM}/cdn-cgi/access/certs`); // Cloudflare’s public keys // 1. the signature must match one of the keys (RS256) // 2. aud must be the thing’s Access application, iss the thing’s team // 3. the ticket must not have expired (exp) // 4. the email must be on the list of administrators (ADMIN_EMAILS) if (!valid) return new Response('For the thing’s administrator only.', { status: 403 }); ``` The whole check is in [functions/_lib/access.js](https://github.com/wi24rd-com/tingsvad-website/blob/main/functions/_lib/access.js) on GitHub. Raw numbers as JSON: [`/api/ting-ai/doeren`](https://tingsvad.dk/api/ting-ai/doeren). The family: [The defences](https://tingsvad.dk/en/machine-room/defences/) · [The crawlers](https://tingsvad.dk/en/machine-room/crawlers/) · [The speed](https://tingsvad.dk/en/machine-room/speed/) · [Denmark right now](https://tingsvad.dk/en/machine-room/denmark/) · [The archive cabinet](https://tingsvad.dk/en/machine-room/archive-cabinet/) · [The thing’s door](https://tingsvad.dk/en/machine-room/the-door/) · [The infrastructure map](https://tingsvad.dk/en/machine-room/map/) · [Back to the machine room](https://tingsvad.dk/en/machine-room/)