A fully programmable secure web gateway

What it is

Cloudflare Gateway can now call customer-written Workers during policy evaluation. The post covers three pieces with different availability. The Forward action is in public beta from the post's date. Custom Functions are "expected before the end of the year". DLP custom validation functions are available now. The post says all three are open to all Zero Trust plans, and that at general availability both Gateway features will be on all plan types.

How it works

Forward applies to traffic already allowed by HTTP policies. The first matching Forward rule sends the request to its bound Worker, which receives full headers and body. The Worker can modify the request, call next(request) to reach the origin, modify the response, and return it. Gateway keeps TCP, TLS termination and re-encryption, certificates and HTTP version negotiation. A Forward Worker can also just observe traffic (Slack, R2, KV, webhook) while the traffic continues.

A Custom Function returns a typed value (string, number or boolean). Gateway exposes it as a selector in network and HTTP rules, so it works for Layer 4 traffic too. It receives identity, device posture and connection metadata, plus headers on HTTP phases.

A DLP validation Worker runs after a detection entry matches and before the enforcement decision. It receives excerpt, start and end (the excerpt is base64) and returns a score. In the GitHub example, 1.0 means active token, "veto" means HTTP 401 so the match is discarded, and 0 covers any other response.

flowchart TD
  A[DLP entry matches] --> B[Validation Worker]
  B -->|"GitHub API ok"| C["score 1.0: profile matches"]
  B -->|"401"| D["veto: match discarded"]
  B -->|"other status"| E["score 0"]

What to do

Choose by workload. The post says Custom Functions suit quick, bounded, stateless lookups. Forward suits transformations of live traffic, and those Workers "should be targeted and designed carefully" to avoid hurting user experience.

Billing is standard Worker requests, on Free, Paid or Enterprise. Workers Free has execution time and daily request limits, which matter as Gateway volume grows.

For failures (exception, timeout, unexpected value), set fallback behavior per function. A default value is required in the function contract.

Enterprise customers can ask their account team for the Custom Functions beta or an implementation session. Email Security is the next integration point.

Caveats

• The post gives no latency or timeout numbers. It says dispatch is a local call with no network hop, so overhead is the Worker's own execution time.
• The JWT sample base64-decodes the payload and does not verify the signature. A rule on that role value trusts whatever the client sends unless the Worker verifies the token.
• The GitHub validator sends the detected token to api.github.com, so the secret leaves the network by design.
• Per the post, Custom Functions cannot yet be used, so the JWT role and complex-evaluation examples are not runnable today.