Edge terminates TLS; this Worker sanitizes JSON, masks Luhn-valid PANs, redacts private IPs, strips debug objects, and can decrypt/re-encrypt AES-GCM field envelopes. Live capability calls require a trusted client certificate.
Browser vs command line: a browser cannot read a local PEM/key through page JavaScript. A positive browser result requires the client certificate to be installed in the browser or operating-system certificate store. The command-line section uses the operator-held certificate with curl; a hosted container or sandbox would hold that credential on behalf of the caller and would not prove the caller’s own browser identity.
| Direct origin | Rewrite Worker | |
|---|---|---|
| Hosts | s3-origin…/ | s3…/ (mTLS) |
| Fixture | /api/fixture raw | Same path via capability — sanitized |
Run a read-only check in this browser. The result explains the response evidence; use the command-line section below for deeper inspection.
Expect raw XSS strings, Luhn PANs, RFC1918 lists, and debug/internal/stack.
Replace client.pem / client.key with the operator-provided pair (never commit keys).
# Reject without cert
curl -s -o /dev/null -w "%{http_code}
" https://s3.thecompany-lab.com/api/fixture
# Sanitized fixture
curl -s --cert client.pem --key client.key https://s3.thecompany-lab.com/api/fixture | jq .
# Inbound XSS sanitize via echo
curl -s --cert client.pem --key client.key -H 'Content-Type: application/json' -d '{"user":{"displayName":"<script>alert(1)</script>"}}' https://s3.thecompany-lab.com/api/echo | jq .
# Binary bypass (byte-identical)
curl -s --cert client.pem --key client.key "https://s3.thecompany-lab.com/api/binary?size=65536" -o /tmp/s3-after.bin
curl -s "https://s3-origin.thecompany-lab.com/api/binary?size=65536" -o /tmp/s3-before.bin
cmp /tmp/s3-before.bin /tmp/s3-after.bin && echo byte-identical
# Optional label list (not a performance claim)
curl -s https://s3.thecompany-lab.com/__rs/latency | jq .
debug / internal / stack removedx-rs-mtls-* headers alone do not authenticateOutbound origin client-certificate proof is an accepted gap for this proxied origin topology. PAN masking is hygiene, not PCI certification.