Key points
- Cloudflare Gateway now supports custom validation functions and a new Forward action for Zero Trust plans.
- The update integrates Cloudflare Workers directly into the policy evaluation path at the edge.
- Customers can transform traffic or inject context without maintaining separate proxy infrastructure.
The short version
- Cloudflare has introduced a new Forward action and custom validation functions for Gateway and Data Loss Prevention.
- These features allow users to run arbitrary code via Cloudflare Workers inline with security decisions.
- The capability is available to all customers on Cloudflare Zero Trust plans.
The details
Cloudflare announced a full-stack integration between its secure web gateway and its developer platform. This move brings the flexibility of Cloudflare Workers directly into Cloudflare Gateway and Data Loss Prevention. According to the company's blog post, this allows customers to run their own code inline during policy evaluation. The new features include a Forward action and custom validation functions. These tools let users transform traffic or bring external data into the decision process. The integration is available to all Zero Trust plans.
Traditional secure web gateways operate on a simple model. Traffic matches a condition, and a terminal action fires. Actions are typically limited to Allow, Block, Isolate, or Log. Cloudflare states this model handles common cases but hits a ceiling for complex environments. The new programmability aims to remove that ceiling by allowing arbitrary logic. This logic runs at the moment a security decision is made. It executes on the same machines and in the same data centers as the gateway.
The context
For years, businesses faced a binary choice in security infrastructure. They could maintain their own detection engines and proxies for maximum customization. This approach carries high maintenance overhead and low portability. Alternatively, they could accept vendor constraints to offload maintenance costs. This trade-off sacrifices flexibility for specific environmental problems. Cloudflare claims thousands of customers struggled with this compromise over six years.
One example involves injecting HTTP headers based on JSON Web Token claims. A security team might need to read JWT data from an identity provider. Standard Gateway policies cannot read the JWT or write the header. Teams often stand up separate NGINX proxies to perform this transformation. That infrastructure then requires indefinite patching, monitoring, and securing. Another example involves sending Slack notifications for new SaaS sign-ups. The policy engine can detect the event but only allows or blocks it. Teams build complex pipelines with delays to achieve real-time alerts.
What to watch
- Monitor for updates on how custom code execution impacts latency in the policy evaluation path.
- Watch for documentation on security controls for the code running in the Workers environment.
- Observe whether other vendors adopt similar inline code execution models for their gateways.
- Check if the Forward action introduces new data handling requirements for compliance teams.
What it means for organisations
Security leaders should assess whether their current gateway policies require complex logic that standard rules cannot handle. Teams usually need to evaluate the risk of allowing custom code execution in the security decision path. Check whether internal development teams have the skills to write and maintain these functions. Determine who within the organization is responsible for auditing the custom logic. Ensure that the operations team understands the maintenance burden of self-written code versus vendor-managed features. Align on governance for code that runs inline with security policies.
What to do and how to stay safe: Cloudflare
- Review current gateway policies to identify use cases that require logic beyond standard allow or block actions.
- Assess the security posture of any custom code that will run inline with traffic evaluation.
- Verify that your Zero Trust plan includes access to the new Workers integration features.
- Once the vendor provides an update, test custom validation functions in a non-production environment.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What new actions are available in Cloudflare Gateway?
Cloudflare is releasing a new Forward action and custom validation functions for Gateway and DLP.
Which plans have access to these programmable features?
These capabilities are available to all customers on Cloudflare Zero Trust plans.
How does this differ from standard API programmability?
True programmability means running your own code inline in the policy evaluation path, not just using APIs or webhooks.
