Cloudflare announced the integration of Cloudflare Gateway and Data Loss Prevention with the Cloudflare Workers edge computing platform, a move that shifts the secure web gateway from a model based on fixed decisions such as allow, block, and isolate to executing custom code within the security policy evaluation path itself.
The integration is available for Zero Trust plans and provides two primary ways to invoke a Worker from Gateway policies: a new action called Forward, currently available in public beta, and Custom Functions, expected to be released before the end of 2026.
Forwarding Requests or Executing Custom Logic
The Forward action operates as an inline intermediary for requests matching the policy. The Worker receives HTTP request headers and body and can modify them before sending them to the origin service, then modify the response before returning it to the user. Gateway handles TCP connections, TLS termination and re-encryption, certificate management, and HTTP version negotiation, leaving the Worker responsible only for transformation logic.
Forward can also be used to perform side effects without interrupting the request path, such as sending an alert to Slack or PagerDuty, logging data to R2, calling a webhook, or updating a KV store. Cloudflare says the Worker is invoked on the same infrastructure that runs Gateway, through a local invocation that does not require routing traffic through a separate network.
Custom Functions, meanwhile, invoke a Worker during policy evaluation and return a string, number, or Boolean value. This value can be used as a selector in HTTP or network policies. The Worker can receive context including the source IP address, user identity, device posture, HTTP headers, and connection data, depending on the policy phase.
Use Cases
Cloudflare explains that a custom function can read a JWT claim and extract the user's role or group, then use the result to allow access or add a header such as X-App-Role to the request headed to the origin service. It is also possible to build interception pages that ask the user to justify access to a sensitive destination, while storing the session in KV and the audit record in D1 or an internal database through Hyperdrive.
Other use cases include scanning files through an external sandbox service, sending immediate alerts when a DLP rule matches, and performing risk calculations based on multiple internal sources. Cloudflare clearly differentiates between the two paths: Custom Functions are suitable for fast, targeted, stateless evaluations, while Forward is intended for live request forwarding and request-and-response processing.
Expanding DLP Capabilities
Cloudflare also announced the availability of custom validation functions for DLP. These functions allow customers to use their own source of truth to validate a detection result before making an enforcement decision. One example is checking whether a detected GitHub key is actually active, rather than relying solely on matching a pattern resembling secrets or tokens.
The validation function receives a data excerpt and the location of the matching portion. It can then call an external API and return a result containing a match score or a veto decision. This makes it possible to distinguish between the presence of a sensitive pattern and whether the specific case represents an actual leak or unauthorized use.
What Changes in Practice?
Cloudflare aims to reduce the need for intermediary infrastructure managed by security teams, such as NGINX clusters used solely to read JWT claims or modify headers. However, the new flexibility shifts part of the responsibility to customer code: applications using Forward must be designed carefully so they do not negatively affect the user experience, and failures or execution timeouts in a Custom Function require fallback behavior to be defined in advance.
Traffic forwarded to Workers is counted as regular Workers requests. The functions work with Workers Free, Workers Paid, and Workers for Enterprise, but the free plan imposes limits on execution time and the number of daily requests. Cloudflare says both paths will be generally available to all customers and across all plan types, while it plans to expand integration points within the Cloudflare One portfolio, with Email Security as the next step.