Cloudflare Workers BYOIP子请求现保留上下文并修正CF-Connecting-IP
Workers, BYOIP, Bots - Workers subrequests now preserve context for BYOIP destinations
涉及BYOIP场景下安全规则评估逻辑与Bot Management判断基准的根本性修正，且跨区请求的CF-Connecting-IP行为发生强制性变更。依赖BYOIP与Workers集成的开发者必须关注此变更，以验证现有安全策略是否按预期生效。
Cloudflare now preserves Workers context when a subrequest targets a Cloudflare-proxied hostname using Bring Your Own IP (BYOIP). These requests are identified as Cloudflare-to-Cloudflare traffic instead of external Internet traffic.
Cloudflare 现在在使用自带 IP（BYOIP）将子请求指向 Cloudflare 代理的主机名时，保留 Workers 上下文。这些请求被识别为 Cloudflare 到 Cloudflare 的流量，而非外部互联网流量。
Previously, some BYOIP subrequests could lose Workers context and original client signals. This could cause security rules to behave unexpectedly, Bot Management to evaluate an internal Cloudflare connection instead of the original client, or affected requests to return false 403 responses.
以前，某些 BYOIP 子请求可能会丢失 Workers 上下文和原始客户端信号。这可能导致安全规则行为异常、Bot Management 评估内部 Cloudflare 连接而非原始客户端，或受影响的请求返回错误的 403 响应。
Workers subrequests to BYOIP destinations now preserve the CF-Worker header and cf.worker.upstream_zone field. This supports consistent security rule evaluation across same-zone and cross-zone subrequests.
发往 BYOIP 目的地的 Workers 子请求现在会保留 CF-Worker 标头和 cf.worker.upstream_zone 字段。这支持跨同区域和跨区域子请求的安全规则评估一致性。
Bot Management fields on the destination zone now represent the original end-user connection for affected BYOIP subrequests. Bot scores, verified bot status, and JA3/JA4 fingerprints no longer represent the internal connection between Cloudflare services.
对于受影响的 BYOIP 子请求，目标区域的 Bot Management 字段现在反映的是原始终端用户连接。Bot 评分、已验证机器人状态以及 JA3/JA4 指纹不再反映 Cloudflare 服务之间的内部连接。
Because Cloudflare-proxied BYOIP destinations now follow standard Workers subrequest handling, cross-zone requests set CF-Connecting-IP to the Workers client IP address 2a06:98c0:3600::103 for security reasons. This applies when a Worker in one Cloudflare zone sends a subrequest to a hostname in another Cloudflare zone. Same-zone subrequests continue to reflect the client IP through CF-Connecting-IP.
由于 Cloudflare 代理的 BYOIP 目的地现在遵循标准的 Workers 子请求处理流程，出于安全原因，跨区域请求会将 CF-Connecting-IP 设置为 Workers 客户端 IP 地址 2a06:98c0:3600::103。当位于一个 Cloudflare 区域的 Worker 向另一个 Cloudflare 区域的主机名发送子请求时会应用此规则。同区域子请求仍会通过 CF-Connecting-IP 反映客户端 IP。
For more information, refer to Cloudflare BYOIP, Workers subrequests, and CF-Connecting-IP in Worker subrequests.
更多信息，请参阅 Cloudflare BYOIP、Workers 子请求以及 Worker 子请求中的 CF-Connecting-IP。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力