內容簡介
DIESIS JWT Auth for Cloudflare Access 外掛可為 WordPress 提供安全的登入保護，確保只有經過 Cloudflare Access 認證的請求能夠訪問特定路徑，增強網站的安全性。
【主要功能】
• 驗證 Cloudflare Access 的 JWT 簽名
• 檢查 JWT 的過期時間和發行者
• 可選擇限制訪問的電子郵件地址
• 針對配置的路徑進行保護
• 快取簽名金鑰達 12 小時
外掛標籤
開發者團隊
② 後台搜尋「DIESIS JWT Auth for Cloudflare Access」→ 直接安裝（推薦）
原文外掛簡介
Cloudflare Access can put a login in front of /wp-admin and /wp-login.php. It only helps if every request really passes through Cloudflare. Without Cloudflare Tunnel, anyone who knows the origin’s address can reach WordPress directly and skip Access entirely.
DIESIS JWT Auth for Cloudflare Access closes that gap. For the paths you choose, WordPress itself checks the Cf-Access-Jwt-Assertion header that Cloudflare Access adds to authenticated requests. A request without a valid token is answered with HTTP 403 before WordPress does anything else.
What it does
Verifies the Access JWT signature (RS256) against the signing keys of your Cloudflare Access team.
Checks expiry, issuer and the application audience of your Access application.
Optionally restricts access to a list of email addresses as a second check at the origin.
Protects the paths you configure, with prefix matching and explicit exclusions.
Caches signing keys for 12 hours and refreshes them when Cloudflare rotates keys.
What it does not do
It does not replace the WordPress login and does not create or log in users. Visitors pass Cloudflare Access first and then sign in to WordPress as usual.
It does not accept Cloudflare Access service tokens. Those carry no email claim and are always denied. Keep machine-to-machine paths such as cron, XML-RPC or the REST API out of the protected paths, or leave them public in both WordPress and the matching Access destination.
Safe defaults
Enforcement only runs when the settings are complete and the issuer is an HTTPS cloudflareaccess.com URL. Incomplete or invalid settings disable enforcement instead of locking you out. If Cloudflare’s key endpoint is temporarily unreachable, a previously cached key set keeps working.
Third-party service
To verify tokens the plugin downloads the public signing keys of your Cloudflare Access team from the issuer you configure, for example https://your-team.cloudflareaccess.com/cdn-cgi/access/certs. No site data is sent; the request is a plain download of public keys, repeated at most every 12 hours or after a key rotation. Cloudflare’s terms and privacy policy apply to that endpoint: Terms, Privacy policy.
Source code, issues and support: github.com/DiesisMedia/diesis-jwt-auth
