A fully programmable secure web gateway
- ID
- 35942
- Status
- summarized
- Published
- 16 Oct 2026, 1:11 AM
- Fetched
- 16 Oct 2026, 2:43 AM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/programmable-gateway-dlp/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 6.0
- Created
- 16 Oct 2026, 2:43 AM
- Tags
- Audience
- developerssaas_founders
What happened
Cloudflare announced two new capabilities for Cloudflare Gateway and DLP: a new 'Forward' action type and custom validation functions, both of which run a Cloudflare Worker inline in the policy evaluation path rather than after the fact. This lets teams transform traffic (for example, read JWT claims and write HTTP headers) or bring their own data into a policy decision, and Cloudflare says both are available to all Zero Trust plans. The post frames this against the 30-year 'match condition, fire terminal action (Allow/Block/Isolate/Log)' model and cites customer workarounds like standing up NGINX proxy pools, or a Logpush-to-SIEM-to-Slack pipeline with a 5 to 15 minute delay.
Why it matters
If you run Cloudflare Zero Trust and you've built a sidecar NGINX pool just to inject headers from IdP JWT claims, or a Logpush-to-SIEM-to-Slack pipeline to alert on SaaS sign-ups, this is the announcement that says you can replace both with a Worker inline in policy evaluation. The decision to make is whether you want to own arbitrary code running in the security decision path — that's the actual trade-off being offered, not a free upgrade. Note there's no pricing or migration detail in the excerpt, so treat the 'all Zero Trust plans' claim as unverified until you check your own plan.
Discussion angle
Cloudflare argues most vendors dilute 'programmability' to mean public APIs, Terraform providers and webhooks — is running arbitrary code inline in the policy evaluation path actually a category difference, or the same flexibility with a new blast radius? Worth asking who on the team reviews and versions that Worker once it sits in the security decision path.