Cloudflare Durable Objects / Live MVP

WebSocket
Control Plane

LIVE ENVIRONMENT

01EYEBALLBrowser client

WSS

02CONTROLWorker + Durable Object

WSS

03ORIGINVPS / Nginx / Node.js

CONCURRENT POLICY 3

open sockets / source IP

MESSAGE POLICY 20

forwarded frames / rolling 60s

GATEWAY STATUS CHECKING

wss-gateway.mbamps.com

TEST 01

Message behaviour

DISCONNECTED

Open one real socket, then send frames through the Worker. Frame 21 is stopped at the edge and never reaches the VPS.

MESSAGE PAYLOAD

0SENT

0VPS ECHOES

0BLOCKED

LIVE TRACE

Frame event stream

Open a WebSocket to begin the trace.

TEST 02

Concurrent connection admission

The gateway reserves three origin slots for each Cloudflare-observed source IP. Diagnostic mode currently displays the exact IP used for every accepted socket.

01READY

02READY

03READY

04READY

The primary demo socket will be closed before this test. DevTools retains its earlier 101 entry.

GENERIC USE CASE / IN-TUNNEL LOGIN

Stop brute force inside the tunnel

A generic gateway converts an in-band WebSocket command into an internal POST /internal/auth/login. There is no HTTP POST body at Cloudflare after the 101 upgrade, so the Worker parses the WebSocket JSON frame itself.

Important

captchaPassed: true is supplied by the client and proves nothing. The backend must validate a real challenge token server-side. This edge policy is compensating protection, not a replacement.

FICTIONAL LIVE PAYLOAD

auth.login command

5 / MIN / IP

{
  "action": "auth.login",
  "username": "demo-user",
  "password": "********",
  "claimedIp": "detected on connect",
  "channel": "demo-web",
  "captchaPassed": true,
  "deviceId": ""
}