Cloudflare introduces programmable secure web gateway with custom Worker actions

Cloudflare is introducing true programmability to Cloudflare Gateway and DLP by integrating them with the Cloudflare Workers edge computing platform. This move addresses the long-standing trade-off between the flexibility of self-managed security infrastructure and the maintenance overhead of vendor solutions, allowing security teams to run arbitrary logic inline during policy evaluation.

New Gateway Entry Points

Two distinct mechanisms allow Workers to interact with Gateway policies:

• Forward action: Routes matched HTTP requests to a Worker acting as inline middleware. The Worker can transform headers, modify request/response bodies, or trigger asynchronous actions like Slack notifications. This eliminates the need for separate proxy pools (e.g., NGINX) for simple transformations.
• Custom Functions: Calls a Worker inline during policy evaluation to return a typed value (string, number, or boolean). This value becomes a selector in the policy builder, enabling complex, stateless evaluations based on internal data sources like JWT claims or risk scores.

DLP Custom Validation

DLP now supports custom validation functions to improve detection accuracy. Instead of relying solely on pattern matching, these functions allow customers to verify if detected data is actively relevant to their organization. For example, a Worker can check if a detected GitHub secret is still active before triggering a policy, reducing false positives.

Availability and Performance

Because Gateway and Workers run on the same infrastructure, dispatching traffic to a Worker is a local function call with no additional network latency. The Forward action is available in public beta today, while Custom Functions are expected to be available before the end of the year. Both features will be available on all Zero Trust plans at general availability, with traffic billed as standard Worker requests.