Cloudflare launches programmable Gateway Forward action and DLP custom validation functions using Workers
Cloudflare announced a product update that integrates Cloudflare Workers with Cloudflare Gateway and DLP, making its secure web gateway programmable. A new Forward action (public beta) routes matched HTTP traffic to a Worker acting as inline middleware, while Custom Functions (expected before year-end) let Workers return typed values used as selectors in Gateway policy conditions. DLP custom validation functions are available now and let customers run their own validation logic against detected data. This is a vendor product announcement with no vulnerability, attack or threat actor activity described.
Technical Details
- Forward action: Workers receive full request headers and body, can modify requests and responses, and can act asynchronously (for example Slack alerts, writes to R2 or KV). It applies to traffic allowed by HTTP policies.
- Custom Functions: Workers receive context such as source IP, user identity, device posture and headers, and return a string, number or boolean. A default value is required for failure handling. They work in network (Layer 4) and HTTP rules.
- DLP validation: After a DLP detection entry matches, a Worker can validate the match before enforcement, for example checking whether a detected GitHub token is still active and returning a score or a veto.
- Use cases cited: purpose-justification interstitial pages, dynamic header injection from JWT claims, file sandboxing or archival, and real-time DLP alerting.
- Availability: works with Workers Free, Paid and Enterprise; traffic is billed as standard Worker requests.
Remediation
No remediation is required. Teams considering the feature should design Forward Workers carefully to avoid degrading user experience, and should note the Workers Free execution-time and request limits.
Linha do tempo
-
Cloudflare launches programmable Gateway Forward action and DLP custom validation functions using Workers
ler a análise desta fonte ocultar
Cloudflare announced a product update that integrates Cloudflare Workers with Cloudflare Gateway and DLP, making its secure web gateway programmable. A new Forward action (public beta) routes matched HTTP traffic to a Worker acting as inline middleware, while Custom Functions (expected before year-end) let Workers return typed values used as selectors in Gateway policy conditions. DLP custom validation functions are available now and let customers run their own validation logic against detected data. This is a vendor product announcement with no vulnerability, attack or threat actor activity described.
Technical Details
- Forward action: Workers receive full request headers and body, can modify requests and responses, and can act asynchronously (for example Slack alerts, writes to R2 or KV). It applies to traffic allowed by HTTP policies.
- Custom Functions: Workers receive context such as source IP, user identity, device posture and headers, and return a string, number or boolean. A default value is required for failure handling. They work in network (Layer 4) and HTTP rules.
- DLP validation: After a DLP detection entry matches, a Worker can validate the match before enforcement, for example checking whether a detected GitHub token is still active and returning a score or a veto.
- Use cases cited: purpose-justification interstitial pages, dynamic header injection from JWT claims, file sandboxing or archival, and real-time DLP alerting.
- Availability: works with Workers Free, Paid and Enterprise; traffic is billed as standard Worker requests.
Remediation
No remediation is required. Teams considering the feature should design Forward Workers carefully to avoid degrading user experience, and should note the Workers Free execution-time and request limits.