Edge scripts
Edge scripts: Lua on the node for custom authentication and redirects, run from a WAF rule action. How to enable, available APIs and failure policy.
What it does
An edge script is a small Lua program that the node runs after a WAF rule matches. It reads request information, then decides to let the request through, return a status code, redirect elsewhere, or add headers to the request or response. Use it for logic that fixed-shape conditions cannot express.
When to use it
- Validate a custom login token or signature header and return 401 when it is missing.
- Redirect visitors to different addresses by cookie, country or path.
- Add a header to the request sent to your origin, or to the response.
How to enable it
Edge scripts are off by default. Two things are needed: the license includes the "Edge scripts" module, and edge scripts are switched on in the account's package. When not enabled, the menu page says "Edge scripts are not enabled yet"; ask the platform operator to enable them.
Where to configure it
- Console menu "Edge scripts": create a script, write the source, run the syntax check, try it, publish.
- In a WAF rule of a security policy, choose the action "Run script" and select a published script.
The script runs after WAF and challenges and before HTTP policy and caching, so cache hits also pass through the script first. In observe mode the rule only logs and does not run the script. A request runs at most one script.
Example
Return 401 when there is no X-Sign request header, otherwise continue:
local sign = cdnca.req.headers["x-sign"]
if not sign then
return cdnca.resp.exit(401)
endAvailable APIs
| Name | Content |
|---|---|
cdnca.req | Read-only: method, uri, args, headers, ip, country, cookie(name); set_header(name, value) changes the request header sent to the origin |
cdnca.resp | set_header(name, value) sets a response header; exit(status) returns a status code; redirect(url, status) redirects |
cdnca.crypto | sha256, hmac_sha256, base64_encode, base64_decode, hex_encode, hex_decode |
cdnca.json | decode, encode |
| Standard library | Common functions of string, table, math and bit, plus assert, error, ipairs, pairs, select, tonumber, tostring, type and unpack |
exit accepts 200, 204 and 400 to 599; redirect accepts 301, 302, 303, 307 and 308.
Settings
| Setting | Default | Range | Description |
|---|---|---|---|
| Name, description | None | The name is unique within the account | |
| On error or limit exceeded | Reject the request (503) | Reject (503), allow | With "allow", a request that errors bypasses the authentication logic in the script |
| Instructions | 100000 | 10000 to 1000000 | Instructions one run may execute |
| Time (ms) | 2 | 1 to 10 | Longest time of one run |
| Memory (KiB) | 2048 | 256 to 16384 | Memory budget of one run |
| Source | None | Up to 32 KiB | Source text only |
Each account can hold 50 scripts, and each script keeps its latest 100 versions.
Versions, publishing and rollback
- "Save draft" only saves; it does not affect live traffic.
- Publishing runs the syntax check first; if it passes, a new version is created and becomes current, and the sites that use it are republished automatically.
- "Roll back to this version" points the current version back at an older one and leaves the draft unchanged; "Load as draft" copies an old version's source into the draft.
- A script used by a rule cannot be deleted.
Trial runs
On the "Trial" tab enter a simulated request (method, URI, client IP, country, headers, cookie). You can run the draft without saving. The result shows continue, the returned status, the redirect target, headers set, or the failure reason. This is a simulation on the control plane; the real result on nodes is in the security log. Each account can run 30 trials per minute.
FAQ
What do visitors see when a script fails
It follows "On error or limit exceeded": by default 503, or with "allow" the request continues. Failure reasons are syntax, instructions, timeout, memory, length or complexity, runtime error and source unavailable.
Where do I see what a script did
In the security log, the detector shows script and the matched text states the script, version and outcome. Only failures and results with a status of 400 or above are recorded; continue and redirect are not.
The check does not pass
The page lists the problems with line numbers, for example a syntax error, a name or field that is not allowed, an expression concatenating more than 16 parts, or source over 32 KiB.
Can a script use print, io, os or call external addresses
Scripts can use only the APIs in the table above.