Building Waiting Room on Workers and Durable Objects
Jun 16, 2021Fabienne Semeria, George Thomas, Mathew Jacob

Summary
This post introduces and details the Cloudflare Waiting Room feature, a new capability designed to manage extreme traffic spikes for web applications. It explains the functionality, configuration options (Total Active Users, New Users Per Minute, Session Duration), and the underlying technical implementation using Cloudflare Workers and Durable Objects. The post elaborates on how Waiting Room protects origin servers by creating an orderly queue, issuing encrypted cookies as tickets, and managing user slots across data centers using historical traffic data and a clustering mechanism for queue position tracking. It also details the structure of the user cookie and the concept of Waiting Room state management.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack