For nearly thirty years, the foundational model of network security has remained remarkably static. Across the market, every secure web gateway operates on a rigid premise: traffic matches a condition, and a terminal action fires. Organizations are given a binary choice of how to handle network flow—traffic is either allowed, blocked, isolated, or logged. While this traditional model has served as the bedrock of enterprise network security and effectively handles common scenarios, it possesses a rigid ceiling. Enterprises managing complex, modern environments hit this operational barrier with increasing frequency, forcing security teams to cobble together auxiliary infrastructure simply to satisfy custom requirements.
Earlier this year, cloud infrastructure and security provider Cloudflare outlined its vision to construct a truly programmable Secure Access Service Edge (SASE) platform. At the time, the company criticized how the term "programmability" had become diluted across the security industry. Most vendors claim programmability simply because they offer public APIs, Terraform providers, webhooks, and alerting mechanisms. While Cloudflare supports all of these features, the company argued that true programmability requires something far more powerful: the ability for organizations to run their own custom code—arbitrary logic tailored specifically to their environment—inline within the policy evaluation path at the exact moment a security decision is made.
Cloudflare is now bringing this capability to life by integrating Cloudflare Gateway and its Data Loss Prevention (DLP) offerings with the entirety of its edge computing platform. The company is introducing a new type of Gateway action known as Forward, alongside custom validation functions available across all Zero Trust plans. These new features empower organizations to leverage Cloudflare Workers to transform and manipulate live traffic dynamically, or to securely bring their own proprietary data sources directly into real-time policy evaluation.
The Trade-Off Faced by Enterprise Security Teams
For as long as firewalls have existed, businesses have been forced to navigate a difficult trade-off between absolute customization and manageable maintenance overhead. Organizations can choose to maintain their own bespoke security detection engines, custom firewalls, and proxy infrastructure, accepting high maintenance costs and low portability in exchange for maximum flexibility. Alternatively, they can accept the inherent constraints of third-party vendor platforms, offloading the substantial maintenance burden while sacrificing the agility required to solve problems unique to their specific corporate environments.
Over six years of developing Cloudflare Gateway, the company has heard from thousands of enterprise customers struggling with this exact dilemma. Consider a security team migrating access controls for a critical internal application that needs to dynamically inject HTTP headers based on JSON Web Token claims originating from their identity provider. Although the necessary data exists within the request context, standard gateways cannot natively read the JWT and write the header. Consequently, the team is forced to deploy and manage a dedicated pool of NGINX proxies solely to execute this minor transformation. That infrastructure must then be perpetually patched, monitored, and secured.
In another common scenario, a security team might want an immediate notification dispatched to a Slack channel the moment an employee signs up for a newly discovered Software-as-a-Service application. While the standard policy engine can easily detect the sign-up event, it is typically restricted to a simple Allow or Block action. To achieve the notification, the team must construct a complex, multi-stage pipeline involving log pushes to a security information and event management system, followed by relay mechanisms to chat tools, introducing noticeable delays and potential delivery gaps.
Dozens of enterprise clients have similarly requested warning pages that prompt users for explicit operational justification before permitting access to sensitive destinations, followed by customized behaviors tailored to user identity and requested access levels. Delivering dynamic, context-aware responses directly from a static policy engine has historically proven exceedingly difficult. While firewall vendors have introduced various extension points over the years, keeping pace with rapidly evolving threat vectors using rigid, predefined features remains an ongoing challenge.
Why Cloudflare’s Architecture Uniquely Solves the Problem
Cloudflare occupies a unique position in the infrastructure landscape, functioning simultaneously as a secure web gateway, content delivery network, edge service provider, and composable compute platform. Through Cloudflare Workers, customers already execute complex application logic across more than 330 data center locations globally. Simultaneously, Cloudflare Gateway evaluates and enforces security policies on user traffic at those exact same locations, utilizing the same physical machines within the same data centers.
This architectural alignment enables Cloudflare to combine these distinct capabilities into the industry’s first fully programmable and customizable SASE platform. Because Gateway and Workers were engineered on shared foundational infrastructure from the outset, when Gateway forwards traffic to a Worker, the dispatch occurs as a local function call. There is no network hairpinning and no additional latency incurred from crossing external network boundaries. This provides organizations with absolute control over proxied traffic processing, allowing them to execute custom code without managing underlying server infrastructure.
Standalone SASE providers that lack an integrated native compute platform require customers to deploy automation logic within separate cloud environments, manually configure webhooks, and absorb the round-trip latency and administrative overhead of stitching together fragmented systems. In contrast, Cloudflare’s co-located edge compute and security gateway architecture provides the speed and flexibility modern security organizations need as digital threats evolve at unprecedented rates.
Forward Actions and Custom Functions
The newly introduced capabilities are delivered through two distinct entry points that call a Worker from a Gateway policy: the Forward action and Custom Functions. The Forward action is currently available in public beta, while custom functions are slated for release before the end of the year.
The Forward action allows administrators to customize HTTP traffic behavior by routing matched HTTP requests to a Worker functioning as an inline proxy. These rules are evaluated for traffic already permitted by standard HTTP policies, sending the matched traffic to a bound Cloudflare Worker. The Worker acts as inline middleware, receiving full request headers and bodies. The custom logic can modify the request, forward it to the origin server, intercept the subsequent response, apply modifications to that response, and return the final output to the user.
Crucially, Gateway handles the underlying complexities of TCP connections, TLS termination, certificate management, and HTTP version negotiation, leaving the Worker responsible solely for the custom transformation logic. Furthermore, Workers do not strictly need to transform traffic; a rule’s sole purpose can be to asynchronously proxy a request to a Worker to trigger external actions—such as sending a Slack message, writing records to Cloudflare R2 object storage, logging to external pipelines, invoking webhooks, or updating key-value stores—while allowing the original traffic stream to continue unimpeded.
Custom functions, meanwhile, call out to a Worker inline during the Gateway policy evaluation phase and return a typed value, such as a string, number, or boolean. Once defined, the function is exposed as a selector within the Gateway policy builder, operating identically to built-in selectors like source IP or content category. These functions receive rich contextual information regarding the request, including user identity, device posture, and connection metadata, enabling complex logic to be evaluated seamlessly across both Layer 4 network rules and Layer 7 HTTP policies.
Expanding Data Loss Prevention with Custom Validation
The vision of a fully programmable SASE platform extends deeply into data security, particularly within Cloudflare’s Data Loss Prevention offerings. Traditional data security products operate primarily by scanning for information that matches known patterns, utilizing regular expressions or word lists. While keywords and context analysis provide some assistance, these conventional detection methods suffer from a fundamental limitation: they can only indicate whether data matches a specific structural pattern, not whether a specific instance of data represents actual misuse or unauthorized exfiltration.
To bridge this gap and improve detection accuracy for sensitive information, Cloudflare is introducing custom validation functions for DLP. These functions allow organizations to define custom validation logic utilizing their own internal sources of truth directly inside a Cloudflare Worker, applying those validation rules across every touchpoint where DLP protects sensitive assets.
For instance, when a DLP detection engine identifies a potential software secret—such as an exposed GitHub API token—an outbound Worker can be automatically dispatched to verify the token’s active status against GitHub’s infrastructure prior to making a policy enforcement decision. If the validation check confirms the token is valid and active, the system can apply a high severity score; if the token is found to be inactive or invalid, the system can veto the detection, significantly reducing false positives and streamlining security operations.
Availability and Future Integration
The Forward action and its deep integration with Cloudflare Workers are available in public beta, with custom functions expected to reach general availability before the end of the year. Upon general availability, both features will roll out across all plan types. Traffic dispatched to Workers is billed under standard Worker request pricing, ensuring accessibility across free, paid, and enterprise tiers.
Looking ahead, Cloudflare plans to expand these programmable entry points across the broader Cloudflare One suite, with Email Security slated as the next integration target. By unifying network security controls with a globally distributed edge compute engine, the company aims to provide enterprises with unprecedented agility in defending their corporate infrastructure against modern threats.
Leave a Reply