Revisit custom domains + Access for Workers Previews

[zachdunn]

Follow-up to #683, which adopted Workers Previews on default workers.dev URLs.

Decision being revisited

Previews currently live at <name>-<worker>.buildinternet.workers.dev. We deliberately did not enable custom preview domains, because our session cookies are .uploads.sh-scoped (crossSubDomainCookies in apps/auth/src/auth.ts — required so the session covers both uploads.sh and auth.uploads.sh, since a cookie Domain attribute cannot enumerate hosts). Any preview hostname under uploads.sh — including a dedicated *.previews.uploads.sh — therefore receives real production session cookies from signed-in visitors, i.e. unreviewed branch code sees live sessions. With many branches agent-authored, a prompt-injected branch could exfiltrate an admin session from anyone who clicks its preview link. workers.dev URLs sit outside the cookie scope, so previews are cleanly logged-out.

Options when revisiting

1. Stay on workers.dev — current state; zero setup, logged-out previews.
2. Dedicated separate zone for previews (e.g. one of the parked domains) — same logged-out security, prettier stable URLs via a wildcard on a zone outside the cookie scope. Aesthetics only.
3. previews_enabled: true on an uploads.sh preview hostname + Cloudflare Access — signed-in preview review out of the box, accepting the cookie exposure above. Access gates who can reach previews but not what branch code sees once a signed-in visitor arrives. Would pair with a norm of only visiting previews of skimmed branches. Note the docs recommend a dedicated preview subdomain when the apex has real subdomains (ours: api./auth./agents./mcp.), since enabling provisions a wildcard DNS record + cert.

References

• Workers Previews docs: https://developers.cloudflare.com/workers/previews/ (during the private beta, the same content is at https://worker-previews-docs-2.preview.developers.cloudflare.com/workers/previews/)
• Custom domains for Previews: https://developers.cloudflare.com/workers/previews/custom-domains/
• Cloudflare Access policies (for gating preview hostnames): https://developers.cloudflare.com/cloudflare-one/access-controls/policies/
• Cookie scoping: apps/auth/src/auth.ts (deriveCookieDomain / crossSubDomainCookies)

Trigger to revisit

Signed-in shareable preview links becoming a real need (today the local portless stack covers signed-in review), or workers.dev URLs proving unworkable for sharing.

[zachdunn]

Update from live usage: workers.dev preview URLs on this account are not public — Cloudflare auto-creates a per-worker Access application gating them, with a policy that allows Build Internet account members (login method: one-time email PIN by default).

Two consequences for this issue:

• The "who can reach previews" half of option 3 already exists on workers.dev for free — custom domains would only add URL aesthetics and the session-cookie exposure. That further weakens the case for option 3.
• The current friction (email PIN) is fixable without custom domains: add GitHub (or Google) as a login method in Zero Trust → Settings → Authentication, enable it on the preview Access apps, turn on instant-auth/auto-redirect (single IdP = zero-click when the IdP session is alive), and raise the app session duration. There is no "signed into the Cloudflare dashboard" IdP — an external SSO provider is the closest equivalent. The auto-created apps are per-worker, so either update all four or replace them with one app covering *.buildinternet.workers.dev.

[zachdunn]

Correction to the previous comment: a "signed into the Cloudflare dashboard" IdP does exist — Cloudflare as an identity provider (shipped 2026-05-19, default for new Zero Trust orgs since 2026-06-18). Users authenticate with their Cloudflare account credentials, with "Restrict to account members" scoping it to this account. It's already present in our IdP list; the preview Access apps just still use One-time PIN because existing orgs keep their configured methods.

Zero-click preview access is therefore: per preview Access app, switch the login method to the Cloudflare IdP, drop OTP, enable instant auth. No third-party IdP needed.