You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Serving local directories with cloudflared built-in fileserver #611
Would like to have similar functionality in cloudflared as currently ngrok provides:
Serving local directories with cloudflared's built-in fileserver
This is how it's implemented in ngrok: ngrok can serve local file system directories by using its own built-in fileserver, no separate server needed! You can serve files using the file:// scheme when specifying the forwarding URL.
Share a folder on your computer with authentication ngrok http -auth="user:password" file:///Users/alan/share
Hope this could be also implemented with cloudflared in the future!
There is a working implementation of this now: #1799
cloudflared tunnel --file ./public (or service: file:/abs/path in a config file) serves a local directory read-only without a separate web server. About 280 lines including tests.
It reuses the existing helloWorld pattern, an in-process listener on 127.0.0.1:0 with httpService.url rewritten to point at it, so no new public listener is introduced and traffic still only arrives through the tunnel.
Hardening is stricter than http.FileServer defaults: GET/HEAD only, no directory listings, dotfiles blocked, symlinks must stay under the root, nosniff, and --file conflicts with --url / --unix-socket.
Verified end to end on Windows over a quick tunnel: 200 for a file, 404 for .env, 404 for ../ traversal, 405 for POST.
If the team prefers a different shape (only the file: scheme with no new flag, configurable index/deny lists, opt-in directory listing), that is easy to adjust.
Activity
hughcube commentedon Nov 13, 2026
There is a working implementation of this now: #1799
cloudflared tunnel --file ./public(orservice: file:/abs/pathin a config file) serves a local directory read-only without a separate web server. About 280 lines including tests.It reuses the existing
helloWorldpattern, an in-process listener on127.0.0.1:0withhttpService.urlrewritten to point at it, so no new public listener is introduced and traffic still only arrives through the tunnel.Hardening is stricter than
http.FileServerdefaults: GET/HEAD only, no directory listings, dotfiles blocked, symlinks must stay under the root,nosniff, and--fileconflicts with--url/--unix-socket.Verified end to end on Windows over a quick tunnel:
200for a file,404for.env,404for../traversal,405for POST.If the team prefers a different shape (only the
file:scheme with no new flag, configurable index/deny lists, opt-in directory listing), that is easy to adjust.