Block on TLS

Inspects the incoming request's TLS version and blocks if under TLSv1.2.

Last updated Apr 23, 2026

export default {
    async fetch(request) {
        try {
            const tlsVersion = request.cf.tlsVersion;
            // Allow only TLS versions 1.2 and 1.3
            if (tlsVersion !== "TLSv1.2" && tlsVersion !== "TLSv1.3") {
                return new Response("Please use TLS version 1.2 or higher.", {
                    status: 403,
                });
            }
            return fetch(request);
        } catch (err) {
            console.error(
                "request.cf does not exist in the previewer, only in production",
            );
            return new Response(`Error in workers script ${err.message}`, {
                status: 500,
            });
        }
    },
};

export default {
    async fetch(request): Promise<Response> {
        try {
            const tlsVersion = request.cf.tlsVersion;
            // Allow only TLS versions 1.2 and 1.3
            if (tlsVersion !== "TLSv1.2" && tlsVersion !== "TLSv1.3") {
                return new Response("Please use TLS version 1.2 or higher.", {
                    status: 403,
                });
            }
            return fetch(request);
        } catch (err) {
            console.error(
                "request.cf does not exist in the previewer, only in production",
            );
            return new Response(`Error in workers script ${err.message}`, {
                status: 500,
            });
        }
    },
} satisfies ExportedHandler;

import { Hono } from "hono";

const app = new Hono();

// Middleware to check TLS version
app.use("*", async (c, next) => {
    // Access the raw request to get the cf object with TLS info
    const request = c.req.raw;
    const tlsVersion = request.cf?.tlsVersion;

    // Allow only TLS versions 1.2 and 1.3
    if (tlsVersion !== "TLSv1.2" && tlsVersion !== "TLSv1.3") {
        return c.text("Please use TLS version 1.2 or higher.", 403);
    }

    await next();

});

app.onError((err, c) => {
        console.error(
            "request.cf does not exist in the previewer, only in production",
        );
        return c.text(`Error in workers script: ${err.message}`, 500);
});

app.get("/", async (c) => {
    return c.text(`TLS Version: ${c.req.raw.cf.tlsVersion}`);
});

export default app;

from workers import WorkerEntrypoint, Response, fetch

class Default(WorkerEntrypoint):
    async def fetch(self, request):
        tls_version = request.cf.tlsVersion
        if tls_version not in ("TLSv1.2", "TLSv1.3"):
            return Response("Please use TLS version 1.2 or higher.", status=403)
        return fetch(request)

Was this helpful?

YesNo

On this page

Docs

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/workers/examples/block-on-tls/#page","headline":"Block on TLS","description":"Inspects the incoming request's TLS version and blocks if under TLSv1.2.","url":"https://developers.cloudflare.com/workers/examples/block-on-tls/","inLanguage":"en","image":"https://developers.cloudflare.com/workers/examples/block-on-tls/og.png?v=1af3a1402201f962","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Security","Middleware","JavaScript","TypeScript","Python"]}

description: Resolve requests to your domain to a set of proxy third-party origin URLs. title: Bulk origin override image: https://developers.cloudflare.com/workers/examples/bulk-origin-proxy/og.png?v=fb9792aef3b12ed5

Skip to content

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/workers/llms.txt
Use this file to discover all available pages before exploring further.