Cloudflare lets Workers sit inline in its secure web gateway

Cloudflare announced today that its Zero Trust Gateway and Data Loss Prevention products can now hand off to a Worker in the middle of a request instead of only matching static rules.

The headline feature is a new Forward action, in public beta today, which routes matched HTTP traffic to a Worker acting as inline middleware: it can rewrite headers or the body, forward to origin, and modify the response before it reaches the user. A related Custom Functions feature, due before the end of the year, lets a Worker run during policy evaluation and return a typed value such as a string or boolean that other rules can then match on. DLP gets its own hook today too: a custom validation function can check whether a flagged match, like a string that looks like a GitHub token, is actually live before DLP blocks it. Traffic sent to these Workers is billed as ordinary Worker requests.

export class GatewayMiddleware extends WorkerEntrypoint {
  async handle(request, context, next) {
    request.headers.set('X-Gateway-Client-IP', context.srcIp);
    const response = await next(request);
    response.headers.set('X-Processed-By', 'gateway-middleware');
    return response;
  }
}

Why it matters: anyone running Cloudflare Gateway or DLP has been limited to fixed rule syntax for conditions and enforcement. Being able to write a Worker that decides the outcome means custom identity checks, live-credential verification, and request rewriting can live in the policy path itself, not in a bolt-on proxy.