padosoft-edge-worker-securitylisted

# Edge worker security An edge worker is not a thin proxy. It terminates the request, decides things the origin will never see, renders pages, and caches. It is a **security boundary of its own** — and the failure mode that produces most of the damage is not a bug in it, it is the ambiguity between it and the origin. **The rule: every control has exactly one owner, written down. When two layers could enforce it, each assumes the other does, and nobody does.** --- ## 1. Split-brain is the headline risk Anti-forgery, header trust, rate limiting, redirect policy, security headers: the edge and the origin can each implement them. Whenever they both can: - **Name the owner in both repositories**, in a comment at the place where the other layer would have done it. A reader of either side must learn, from that side, who actually enforces it. - **If both sides keep a list** — exclusions, allow-lists, trusted paths — those lists are one artefact with two copies, and they drift. Align them in the same change, or generate one from the other. An exclusion added on one side only leaves the route uncovered on **both**. - **Do not assume a control is on. Open the file and read the flag.** A switch built as a literal in the source is the production value; a switch read from configuration may be absent. When the origin delegates to the edge and the edge is disabled, the control does not exist anywhere — and everything looks normal. ## 2. Anti-forgery, when the edge is the gat