Using Cloudflare Workers to identify pwned passwords

What this post added

This post introduces the implementation of a Cloudflare Worker that intercepts POST requests, extracts a 'password' field, calculates its SHA-1 hash, and checks for its presence in Troy Hunt's Pwned Passwords API using the k-anonymity scheme. The Worker then adds a `Cf-Password-Pwnd` header to the outgoing request based on the check result. It provides example Perl and JavaScript code for the functionality and demonstrates its usage with curl.