Cloudflare Gateway lets Zero Trust users run custom validation via Workers for complex traffic checks

Cloudflare has announced a significant update to its secure web gateway and data loss prevention services. The company is integrating its Cloudflare Workers platform directly into the policy evaluation path. This allows users to execute custom code inline when security decisions are made. The update targets organisations with complex environments that require more flexibility than standard allow or block rules provide.

Root cause

Traditional secure web gateways rely on static conditions that trigger terminal actions such as blocking or logging traffic. This model, used for nearly thirty years, handles common cases but lacks flexibility for complex scenarios. Cloudflare identified that customers often hit a ceiling with these rigid rules. To address this, the company developed a way to run arbitrary logic written by the user within the gateway itself.

Attack path

This update does not involve a vulnerability or attack vector. Instead, it introduces a new capability for organisations to manipulate traffic. Users can now transform requests, such as injecting HTTP headers based on JSON Web Token claims, without maintaining separate proxy infrastructure. It also enables immediate notifications for events like SaaS sign-ups, removing delays associated with external logging pipelines.

Affected versions

The new programmable features are available to all Cloudflare Zero Trust plans. The capabilities include a new Gateway action called Forward and custom validation functions. These tools allow organisations to bring their own data to the policy evaluation process. The integration leverages the existing Cloudflare Developer platform and edge computing infrastructure.

Mitigation

• Review current security policies to identify gaps that require custom logic.
• Test custom validation functions in a staging environment before production use.
• Ensure development teams understand the security implications of inline code execution.
• Monitor performance impacts of running custom logic on the network edge.

What it means for organisations

Security teams should evaluate whether their current gateway rules are sufficient for unique business requirements. Organisations need to determine if maintaining separate infrastructure for traffic transformation is still necessary. Internal stakeholders, including engineering and compliance teams, should be informed about the ability to run custom code. This shift allows for more tailored security responses but requires careful governance of the code being deployed.

Background: Data loss prevention

Data loss prevention rules are policies that monitor, detect, and block sensitive data from leaving an organisation. They work by scanning content for specific patterns like credit card numbers or code snippets. You must configure them to balance security with workflow efficiency, ensuring legitimate business activities are not interrupted while preventing accidental or malicious exfiltration.

Read the full guide: Data Loss Prevention Rules: How to Stop Leaks Without Blocking Work

What to do and how to stay safe: Cloudflare

• Audit existing gateway configurations to identify use cases that could benefit from custom logic.
• Develop and test custom validation functions in a controlled environment before deployment.
• Establish guidelines for code review and approval for any inline scripts.
• Monitor system performance to ensure custom logic does not introduce latency.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What new action does Cloudflare Gateway introduce?

Cloudflare Gateway introduces a new Forward action and custom validation functions.

Who can access these new programmable features?

These capabilities are available to all Cloudflare Zero Trust plans.

How does this differ from previous gateway functionality?

It allows running custom code inline during policy evaluation, rather than just matching static conditions.