|  | 
|  | 1 | +--- | 
|  | 2 | +pcx_content_type: configuration | 
|  | 3 | +title: Skew Protection | 
|  | 4 | +head: [] | 
|  | 5 | +description: Revert to an older version of your Worker. | 
|  | 6 | +--- | 
|  | 7 | +import { DashButton } from "~/components"; | 
|  | 8 | + | 
|  | 9 | +Skew Protection ensures that client-side JavaScript code continues to communicate with the same version of your Worker that originally served it, preventing version mismatch errors during deployments. | 
|  | 10 | + | 
|  | 11 | +Version skew occurs when a user's browser has loaded JavaScript from one version of your application, but subsequent requests (such as API calls or asset fetches) are handled by a different, incompatible version. For example, imagine your newest deployment changes an API endpoint's response format. Users with JavaScript from the old version loaded in their browser would receive responses they cannot parse, leading to application errors. | 
|  | 12 | + | 
|  | 13 | +Cloudflare's Skew Protection resolves this problem automatically by ensuring all requests from a client session are routed to the same Worker version that served the initial page load. This works seamlessly with gradual deployments, allowing you to safely roll out new versions without breaking active user sessions. | 
|  | 14 | + | 
|  | 15 | +### How it works | 
|  | 16 | + | 
|  | 17 | +Skew Protection works automatically for all requests without requiring any configuration or code changes. Cloudflare handles version consistency at the platform level for both client-to-server requests and Worker-to-Worker service binding calls. | 
|  | 18 | + | 
|  | 19 | +#### Automatic version tracking for clients | 
|  | 20 | + | 
|  | 21 | +When a user first loads your application, Cloudflare automatically: | 
|  | 22 | + | 
|  | 23 | +1. Sets a version cookie (`__cf_worker_version`) containing the deployment ID that served the initial page load | 
|  | 24 | +2. Includes this cookie in all subsequent requests from the same browser session | 
|  | 25 | +3. Routes requests to the same Worker version that set the cookie | 
|  | 26 | +4. Maintains old deployments for active sessions during gradual rollouts | 
|  | 27 | + | 
|  | 28 | +#### Skew protection during a gradual rollout | 
|  | 29 | + | 
|  | 30 | +1. User visits your site and gets Version A (latest deployment) | 
|  | 31 | +2. Cloudflare sets cookie: `__cf_worker_version=version-id` | 
|  | 32 | +3. You deploy Version B with breaking API changes | 
|  | 33 | +4. You create a gradual deployment: Version B at 20%, Version A at 80% | 
|  | 34 | +5. User's browser makes an API call with the cookie | 
|  | 35 | +6. Cloudflare routes the request to Version A (matching the cookie) | 
|  | 36 | +7. User's session continues working without errors | 
|  | 37 | + | 
|  | 38 | +New users visiting the site have a 20% chance of getting Version B and will consistently use Version B for their session. | 
|  | 39 | + | 
|  | 40 | +### Service bindings and version consistency | 
|  | 41 | + | 
|  | 42 | +When using service bindings to connect multiple Workers, Skew Protection automatically propagates version context across Workers. | 
|  | 43 | + | 
|  | 44 | +When Worker A calls Worker B: | 
|  | 45 | + | 
|  | 46 | +1. Cloudflare detects the version context from the original client request | 
|  | 47 | +2. Worker B is routed to a compatible version from its own version history | 
|  | 48 | +3. The same version context is used for any subsequent Worker calls | 
|  | 49 | + | 
|  | 50 | +This ensures that for a given client session, all Workers in your architecture use consistent, compatible versions without any manual coordination. | 
|  | 51 | + | 
|  | 52 | +### Session expiration and version cleanup | 
|  | 53 | +Sessions naturally expire after 12 hours (or your configured duration): | 
|  | 54 | + | 
|  | 55 | +- When a session expires, the user's next request creates a new session with current versions | 
|  | 56 | +- Old Worker versions remain available as long as there are active sessions using them | 
|  | 57 | +- Once all sessions using an old version have expired, that version can be safely deleted | 
|  | 58 | + | 
|  | 59 | +## Setting a version cutoff | 
|  | 60 | + | 
|  | 61 | +For critical security fixes, you can set a version cutoff to immediately stop serving older versions. | 
|  | 62 | +```bash | 
|  | 63 | +# Cut off all versions before a specific deployment | 
|  | 64 | +npx wrangler versions cutoff set  | 
|  | 65 | + | 
|  | 66 | +# Or cut off to the latest | 
|  | 67 | +npx wrangler versions cutoff set --latest | 
|  | 68 | +``` | 
|  | 69 | +This forces all users to the cutoff version or newer on their next request, even if their session hasn't expired. | 
0 commit comments