Workers Hono Access Middleware

cf-access.ts

import { createMiddleware } from 'hono/factory';
import { HonoEnv } from '../routers/api';
import * as jose from 'jose';

const zeroTrustAccount = "<account-name>"
const zeroTrustAppAud = "<application-audience>"
const JWKS = jose.createRemoteJWKSet(new URL(`https://${zeroTrustAccount}.cloudflareaccess.com/cdn-cgi/access/certs`));

export const cloudflareAccess = createMiddleware<HonoEnv>(async (c, next) => {
  const jwt = c.req.header('cf-access-jwt-assertion');
  if (!jwt) {
    return c.json({ error: 'Unauthorized (missing jwt header)' }, 401);
  }
  
  try {
    const { payload } = await jose.jwtVerify<{ email: string }>(jwt, JWKS, {
      issuer: `https://${zeroTrustAccount}.cloudflareaccess.com`,
      audience: zeroTrustAppAud,
    });

    c.set('user', { email: payload.email });
    await next();
  } catch (e) {
    return c.json({ error: 'Unauthorized' }, 401);
  }
});