Staging Environment Auth Wall

Lock Down Your Staging Sites Without Touching a Line of App Code

Deploy a Cloudflare Worker that wraps any subdomain in HTTP Basic Auth — no origin changes, no extra infrastructure. Perfect for staging, preview, and QA environments that should not be publicly accessible.

What's Included

• Cloudflare Worker script with configurable username/password pairs
• wrangler.toml pre-configured for route-based deployment
• Support for multiple username/password credentials via environment variables
• .env.example with all required Wrangler secrets documented
• README with step-by-step deployment instructions

How It Works

The Worker intercepts every request to your configured routes. If the request does not include a valid Authorization: Basic header, it returns a 401 with a WWW-Authenticate challenge. Valid credentials are stored as Wrangler secrets — never in source code.

What You Get

• Runs at Cloudflare's edge in 200+ cities — zero latency overhead on authorized requests
• Works with any origin: Next.js preview, Rails staging, static S3 bucket, anything
• No server, no container, no maintenance
• Credentials rotate without redeploying your app

Requirements

• Cloudflare account (free tier works)
• Domain on Cloudflare DNS
• Wrangler CLI installed (npm install -g wrangler)