Letting the browser POST straight to Cloudflare Images with Direct Creator Upload

Sat, 04 Jul 2026 00:00:00 +0000

Multi-megabyte image uploads should not travel through a Pages Function on the way to storage. They do not have to.

This is part of the photography portfolio series . It covers how the admin upload flow on alex.edestudio.us and jamie.edestudio.us sends photos straight from the browser to Cloudflare Images without proxying the bytes through my own code.

The three-request handshake ¶

Every upload is three sequential requests from the browser. The Pages Function in the middle never sees the image bytes.

Hardened admin auth on Cloudflare Pages: JWT validation, AUD pinning, and pages.dev lockdown

Fri, 26 Jun 2026 00:00:00 +0000

Every admin request to the photography portfolio goes through three checks before it can touch a D1 row or a Cloudflare Images API call: the Cloudflare Access edge proves identity, the Pages Function verifies the JWT Access minted, and the verifier rejects anything whose audience claim does not match this specific application.

This post is how that pipeline is built, why each layer is there, and the operational decisions around it.

Pages Functions on Jamie Ede

Letting the browser POST straight to Cloudflare Images with Direct Creator Upload

The three-request handshake ¶

Hardened admin auth on Cloudflare Pages: JWT validation, AUD pinning, and pages.dev lockdown