A fully programmable secure web gateway
Cloudflare introduces programmable secure web gateway features, enabling customers to run custom code inline with security policies via Workers, addressing long-standing flexibility limitations in network security.
For decades, secure web gateways have relied on a rigid model where traffic matches a condition and triggers a fixed action—Allow, Block, Isolate, or Log—limiting customization for complex environments. Cloudflare argues this approach fails to meet the needs of organizations with unique security requirements, despite industry claims of programmability through APIs or automation tools. The company emphasizes that true programmability requires executing arbitrary logic written by customers directly within the policy evaluation path, at the moment a security decision is made.
To address this gap, Cloudflare is integrating its Gateway and Data Loss Prevention (DLP) services with its edge computing platform, enabling customers to use Cloudflare Workers for inline traffic transformation or policy evaluation. A new Gateway action, Forward, and custom validation functions are being introduced to all Zero Trust plans, allowing businesses to manipulate HTTP traffic or incorporate external data into policy decisions without deploying additional infrastructure.
The announcement highlights practical limitations of traditional gateways, such as the inability to read JWT claims to inject HTTP headers or trigger real-time notifications for SaaS sign-ups, forcing teams to build and maintain separate proxy infrastructure. Cloudflare’s solution eliminates this overhead by enabling Workers to act as inline middleware, modifying requests or responses, or performing asynchronous actions like sending Slack alerts, while Gateway handles underlying network functions like TLS termination and certificate management.
Cloudflare positions itself uniquely by combining its distributed compute platform with a full-featured secure web gateway, allowing Gateway policies to forward traffic to Workers with no additional latency. The Forward action and Custom Functions—available in public beta and by year-end, respectively—enable administrators to write custom logic that integrates seamlessly into policy rules, such as allowing access based on JWT roles or other contextual data, without sacrificing performance or operational simplicity.