The Two Scripts Cloudflare Appends to Every One of Our 56 Pages: 1,239 Bytes of Email Decoding and a 31,853-Byte Analytics Beacon

I work on OnePassApps, the team behind app.onepassapps.com. Every number below was measured on today's build over plain HTTPS from outside the browser - no session, no cookies, no JavaScript - so what you read here is what the server hands out, not what a rendered page does with it.

Our sitemap lists 56 URLs. I fetched every one of them once and read the HTML the server returned. Two of the script tags in each document are not ours: the edge appends them, and they are identical on all 56 pages.

The two scripts

The first is Cloudflare's email decoder, served from our own host at /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js. It answers HTTP 200, carries 1,239 bytes and is served as application/javascript. Its tag is exactly this:

<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js">

There is no integrity attribute on it and no crossorigin attribute - just data-cfasync="false", which tells the browser it may be fetched without blocking the parser.

The second is Cloudflare's analytics beacon, which lives on a host that is not ours: https://static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092. It answers HTTP 200 with 31,853 bytes, served as text/javascript;charset=UTF-8. Its tag carries four things at once: type="module", crossorigin="anonymous", an integrity attribute with a sha512 hash, and a data-cf-beacon payload.

The payload has exactly four keys: r, spa, token, version. The version reads 2024.11.0, r reads 1, spa reads 2, and the token is 32 hex characters. It is the same payload on all 56 pages - one variant, not 56.

The integrity attribute does match the bytes

Because the beacon tag carries a sha512 hash, I hashed the 31,853 bytes Cloudflare served and compared the digest with the one in the tag. They are the same string, so a browser that checks the hash finds a match.

Where they sit, and what else is in the document

Both edge scripts come after the closing footer tag and before the closing body tag on all 56 pages. The rest of the document is ours: 155 script tags across the fleet, and not one of them carries an integrity attribute.

What our own header does not name

All 56 responses carry the same Content-Security-Policy header, and the same script-src directive. That directive lists 7 tokens: 'self', one sha256 hash, 'wasm-unsafe-eval' and 4 host names.

Neither edge script is named there. The beacon's host, static.cloudflareinsights.com, is not in script-src on any of the 56 pages, and the path the email decoder is served from is not named either - it is same-origin, so 'self' covers it.

We did not open these pages in a browser and we did not run any of this JavaScript, so we are not going to claim what a browser does with the beacon tag. This is a report of what the header and the markup say.

What this does not cover

One build, one day, one fetch per URL, plain HTTPS from one network, signed out. The 56 URLs are the ones in our sitemap and are not an inventory of the site. We did not measure the browser's view of any of this, did not compare against another build, and did not look at any analytics data. The 33,092 bytes are the sizes of the two files as served over the wire, not their size on disk.

Try it yourself: https://app.onepassapps.com?utm_source=devto&utm_medium=post&utm_campaign=edge-script-layer&utm_content=home-link
The guides list every app we have: https://app.onepassapps.com/guides?utm_source=devto&utm_medium=post&utm_campaign=edge-script-layer&utm_content=guides-link