Worker Isolation

Worker Isolation

Last updated Apr 21, 2026

Untrusted Mode (Default)

By default, Workers inside of a dispatch namespace are considered "untrusted." This provides the strongest isolation between Workers and is best in cases where your customers have control over the code that's being deployed.

In untrusted mode:

The request.cf object is not available in Workers (see limits for more information)
Each Worker has an isolated cache, when using the Cache API or when making subrequests using fetch(), which egress via Cloudflare's cache
caches.default is disabled for all Workers in the namespace

This mode ensures complete isolation between customer Workers, preventing any potential cross-tenant data access.

Trusted Mode

If you control the Worker code and want to disable isolation mode, you can configure the namespace as "trusted". This is useful when building internal platforms where your company controls all Worker code.

In trusted mode:

The request.cf object becomes available, providing access to request metadata
All Workers in the namespace share the same cache space when using the Cache API

Note

In trusted mode, Workers can potentially access cached responses from other Workers in the namespace. Only enable this if you control all Worker code or have appropriate cache key isolation strategies.

To convert a namespace from untrusted to trusted:

curl -X PUT "https://api.cloudflare.com/client/v4/accounts/{account_id}/workers/dispatch/namespaces/{namespace_name}" \
  -H "Authorization: Bearer {api_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "{namespace_name}",
    "trusted_workers": true
  }'

If you enable trusted mode for a namespace that already has deployed Workers, you'll need to redeploy those Workers for the request.cf object to become available. Any new Workers you deploy after enabling trusted mode will automatically have access to it.

Maintaining cache isolation in trusted mode

If you need access to request.cf but want to maintain cache isolation between customers, use customer-specific cache keys or the Cache API with isolated keys.

Platform Limits - Understanding script and API limits
Cache API Documentation - Learn about cache behavior in Workers
Request cf object - Details on the cf object properties

Was this helpful?

YesNo

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/reference/worker-isolation/#page","headline":"Worker Isolation","description":"Choose between untrusted and trusted isolation modes for user Workers in a Workers for Platforms dispatch namespace.","url":"https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/reference/worker-isolation/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/reference/worker-isolation/og.png?v=f24b2702c435c827","dateModified":"2026-04-21","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}