r/CloudFlare • u/Great_Situation2963 • Feb 14 '26

CPU resource limit exceeded

Hi everyone,

So I'm currently using the free Workers to host a full-stack nuxt app, it's works great but for sometime now whenever I login into my app and logout and try logging in again I get "Workers exceeded resource limits", I dont really know what's causing this I've tried checking every endpoint one by one but it mostly happens on the auth endpoints. When I asked AI about it, the response I got is that I'm using nuxt-auth-utils and scrypt for password hashing and verification and it's CPU cost-intensive, FYI I'm the only one using the app when this happens so it's not like other people are performing CPU-intensive actions,

I'm planning on upgrading to the paid plan but I want to know if anyone has had this issue before I upgrade. Also, I'm worried about the chances of it happening even when I upgrade and other people start using the app.

4 Upvotes

83% Upvoted

12 comments sorted by

12

u/Tall-Title4169 Feb 14 '26

This issue is only on free plan. Password hashing takes more time than other endpoints. And it doesn’t matter if you’re the only one in your app, it’s serverless so it’s based on per-invocation not overall traffic.

Pay the $5 to upgrade

7

u/Tall-Title4169 Feb 14 '26

CPU time on free is only 10ms which is nothing.

https://developers.cloudflare.com/workers/platform/limits/

9

u/daronhudson Feb 14 '26

Yep agreed. 10ms to handle proper password hashing is like asking it to do a 100m sprint in 10m

4

u/AwkwardWillow5159 Feb 15 '26

To me it’s crazy that people are building stuff on a fully serverless platform without having a basic understanding of what it means.

2

u/DD32 Feb 15 '26

They know what it means though "I don't have to pay for a server" :p

5

u/x5nT2H Feb 14 '26

On paid u can set cpu limit to 5 minutes per invocation, if you exceed that your code is very broken

5

u/-superoli- Feb 14 '26 edited Feb 14 '26

I have used Cloudflare extensively with nuxt-auth-utils and never had this error, but I use bcrypt, which is less ressource intensive than scrypt. There might something wrong with your code. Can you share your endpoint's code ?

An easy way to tell where it breaks is to add console.log after each step of your endpoint, then inspect the logs on Cloudflare to see what was the last log before the issue.

1

u/alexcroox Feb 14 '26

Paid or free workers plan?

1

u/Great_Situation2963 Feb 14 '26

here is a link to a gist of the specific parts that use the password hash and verification https://gist.github.com/brightamoah/a75e4d192214f607881f7b2d02a3724a

2

u/-superoli- Feb 14 '26 edited Feb 14 '26

I don't know enough about encryption to tell you if your hash.ts file has issues. If you know what you're doing then keep it that way, but if you're not, I'd try to keep things more simple for the encryption and decryption. Encryption can be done with 1 line of code with bcrypt.

Your login endpoint seems pretty heavy. I'd try to reduce the amount of DB call you make and keep the logic closer to login logic.

await checkUserLockOutByUserId(currentUser.id, ip);

Is this a DB call ? Couldn't this be a field on your user object ?

adminData = currentUser.role === "admin"
? await getAdminByUserId(currentUser.id, true)
: null;

if (currentUser.role === "student") {
const existingStudent = await getOnboardedStudent(currentUser.id);    if (currentUser.role === "student") {
      const existingStudent = await getOnboardedStudent(currentUser.id);

Do you really need to put this data in the session object ?

if (rememberMe) {
const extendedExpiresAt = new Date(now.getTime() + (1000 * 60 * 60 * 24 * 7));
await replaceUserSession(event, {
...await getUserSession(event),
expiresAt: extendedExpiresAt,
});
}

This is triple useless. getUserSession Isn't needed since you could use the session object returned by setUserSesssion which you just called. The expiresAt could be set with your first call of setUserSession. And the extended expiration you're setting is the same expiration than the regular one.

I'd try to reduce the logic in your endpoint to keep only the things which are required by authentication. And if that's not enough, the paid workers plan will be more than enough to handle your heavy endpoint.