For nearly thirty years, the fundamental model of network security has remained remarkably static. Across the market, every secure web gateway operates on a straightforward paradigm: traffic matches a predefined condition, a terminal action fires, and the system decides whether to allow, block, isolate, or log the data. While this architecture has long served as the bedrock of enterprise network security and effectively manages common routing scenarios, it possesses an inherent operational ceiling. Organizations operating complex, modern hybrid environments run up against these boundaries with increasing frequency, forcing security teams to cobble together secondary proxies, webhook pipelines, and external automation platforms just to achieve basic customization.
Cloudflare is seeking to disrupt this decades-old limitation by integrating its secure web gateway and Data Loss Prevention (DLP) offerings with its global edge computing platform. The company has announced the rollout of a new class of gateway actions and custom validation functions across its Zero Trust ecosystem. By allowing security policies to invoke Cloudflare Workers inline, organizations can now execute arbitrary logic, transform and manipulate live traffic, and bring custom data sources directly into policy evaluation without sacrificing performance or spinning up independent infrastructure.
The Compromise Faced by Enterprise Security Teams
Since the advent of traditional firewalls, organizations have been forced to navigate a challenging binary choice. On one side, engineering teams can maintain their own bespoke security detection engines, custom proxy infrastructures, and proxy pools. This path grants maximum customization and flexibility, but it introduces staggering maintenance overhead, infrastructure management costs, and low portability. On the other side, businesses can accept the rigid constraints of commercial vendors, offloading the considerable cost of infrastructure maintenance at the expense of solving unique problems tailored to their distinct operational environments.
Over six years of developing Cloudflare Gateway, the company reports hearing from thousands of enterprise customers who struggle daily with this operational trade-off. For instance, a security team migrating access controls for a critical internal application often needs to inject HTTP headers based on JSON Web Token claims issued by their third-party identity provider. Because the necessary data exists within the request context, but standard gateways cannot read the JWT and write the header, teams are frequently forced to deploy standalone pools of NGINX proxies solely to perform this routine transformation. That auxiliary infrastructure then requires continuous patching, monitoring, security hardening, and ongoing maintenance.
Another common scenario involves security teams that want immediate notifications—such as a Slack alert—the moment an employee signs up for an unapproved SaaS service. While a traditional policy engine can easily detect the sign-up event, it is typically restricted to a binary allow or block decision. To bridge this gap, engineers often construct complex, multi-layered data pipelines involving log forwarding services, security information and event management systems, and messaging integrations. These makeshift pipelines frequently introduce significant delays of up to fifteen minutes while offering no absolute guarantee of message delivery, adding yet another fragile piece of infrastructure to the corporate stack.
Similarly, dozens of enterprise organizations have requested customizable warning pages that prompt end users to provide a business justification before accessing sensitive internal destinations. Most teams subsequently want to dynamically tailor the ensuing network behavior based on contextual details regarding who the user is and the specific level of access requested. Historically, serving dynamic, customized responses directly from a static security policy engine has been exceedingly difficult, prompting vendors to rely on rigid extension points that struggle to keep pace with rapidly evolving threat vectors.
A Uniquely Positioned Edge Architecture
Cloudflare argues that this persistent industry dilemma can only be solved by an infrastructure model that unifies distributed compute with enterprise security gateways. Unlike standalone SASE providers that require organizations to deploy automation scripts in separate public clouds, manually configure webhooks, and absorb the round-trip latency of stitching together disconnected systems, Cloudflare operates a composable compute platform distributed across hundreds of cities worldwide.
Because Cloudflare Workers and Cloudflare Gateway are built upon the same underlying infrastructure, dispatching traffic from a security policy to a Worker operates as a local function call. There is no artificial hairpinning and no additional network latency introduced by crossing external boundaries. When Gateway forwards traffic to a Worker, the Worker handles specific transformation tasks while the core network infrastructure manages TCP connections, TLS termination, certificate management, and HTTP version negotiation. This co-location allows organizations to execute custom logic inline with proxied traffic without bearing the operational burdens of hosting traditional, standalone HTTP proxies.
Introducing Forward Actions and Custom Functions
To bridge the gap between static security policies and dynamic enterprise logic, Cloudflare is introducing two distinct entry points for calling Workers from a Gateway policy: the Forward action and Custom Functions.
The Forward action allows administrators to customize HTTP traffic behavior by routing matched requests to a Worker functioning as an inline proxy. Evaluated for traffic permitted by standard HTTP policies, the first matching forward rule directs the request to a designated Cloudflare Worker. Operating as inline middleware, the Worker receives the full request headers and body. The code can then choose to modify the request, forward it to the origin server, inspect the response, alter the return data, and send the final response back to the user. Alternatively, organizations can use the Forward action asynchronously—forwarding request context to a Worker that triggers notifications, logs events, or updates external storage without altering the primary flow of user traffic.
In contrast, Custom Functions are designed for inline policy evaluation during the security decision-making process. A custom function calls out to a Worker during policy evaluation, receives request metadata such as source IP, user identity, device posture, and HTTP headers, and returns a typed value—such as a string, number, or boolean. This returned value is then exposed as a dynamic selector within the Gateway policy builder, allowing administrators to construct rules that evaluate custom logic alongside built-in parameters like source IPs or content categories. These custom functions are not restricted to HTTP traffic; because they evaluate connection metadata and identity, they can also be applied within Layer 4 network policy rule builders.
Practical Applications for Enterprise Security
The integration of edge computing with security gateways unlocks a wide range of use cases that were previously difficult or impossible to implement cleanly within traditional SASE architectures.
Organizations can deploy purpose-justification workflows where a Worker intercepts requests to sensitive destinations, presenting users with an interstitial page that mandates a written reason for access. By integrating with Cloudflare’s distributed key-value stores or database products, the system can cache user sessions to avoid repetitive prompts while maintaining an immutable audit trail for compliance officers.
Similarly, security teams can implement dynamic HTTP header injection by having a custom function parse a JWT authorization token directly from incoming requests. By extracting user roles or group memberships and returning them as selector values, Gateway rules can automatically inject upstream headers without maintaining auxiliary proxy pools. Furthermore, security engineers can configure file inspection routines that automatically route downloaded assets to third-party sandboxing services or archive them permanently to cloud storage objects for later analysis, all without the files ever leaving the secure edge network.
Real-time alerting can also be streamlined. Workers bound to Forward policies can instantly dispatch webhook payloads to Slack channels or incident management platforms the moment a data loss prevention profile matches suspicious activity, replacing delayed log-forwarding pipelines with instantaneous visibility.
Enhancing Data Loss Prevention with Custom Validation
Beyond network access control, Cloudflare is extending its programmable architecture to its Data Loss Prevention suite. Traditional data security products typically detect sensitive information by scanning for static patterns using regular expressions, predefined word lists, or keyword proximity checks. While useful, these pattern-matching techniques possess a fundamental flaw: they can identify when data matches a specific format, but they struggle to determine whether a specific instance of data represents genuine exfiltration or authorized business activity.
To address this challenge without forcing organizations to transfer sensitive reference datasets to third-party vendors for exact data matching, Cloudflare is releasing custom validation functions for DLP. These functions allow enterprises to define proprietary validation logic using their own internal sources of truth directly inside a Cloudflare Worker.
For instance, when a DLP detection engine identifies a potential GitHub personal access token in outbound traffic, an outbound Worker can be dispatched to query the official GitHub API in real time. If the API confirms the token is active and valid, the DLP engine assigns a high severity score; if the API returns an unauthorized status indicating the token is dead or revoked, the system can automatically veto the match and allow the traffic to proceed safely.
Availability and Future Roadmap
The Forward action and its integration with Cloudflare Workers are available in public beta, with Custom Functions scheduled for release before the end of the year. Upon general availability, both capabilities will be accessible to customers across all plan types, with traffic dispatched to Workers billed under standard Cloudflare Worker pricing structures. Cloudflare indicates that this release marks the initial phase of a broader rollout to bring programmable extensibility to the entirety of its Cloudflare One suite, with Email Security slated as the next integration target.
Leave a Reply