A proxy fleet existed to copy one header

Every secure web gateway on the market works the same way, Cloudflare argues: traffic matches a condition and a terminal action fires, allow, block, isolate or log. The model is nearly thirty years old and handles the common case well, but complex environments hit its ceiling regularly. The two examples the company gives are the useful part of the announcement.

A security team migrating access controls for a critical internal application needed to inject HTTP headers based on JSON Web Token claims from its identity provider. The data existed in the request context, but the gateway could not read the token and write the header, so the team stood up a pool of NGINX proxies to perform that one transformation, infrastructure that then had to be patched, monitored and secured indefinitely. Another team wanted a Slack notification the moment an employee signed up for a new service. The policy engine could detect the sign-up but could only allow or block, so the alert went through a Logpush-to-SIEM-to-Slack pipeline with a five to fifteen minute delay and no guarantee of delivery.

Cloudflare's answer is to run customer code inline in the policy evaluation path, at the moment the decision is made. It is releasing a new Gateway action called Forward, plus custom validation functions, available on all Zero Trust plans, which let a Worker transform and manipulate traffic or bring external data into policy evaluation.

The company also draws a line around the word programmable, which it says the security industry has diluted. Public APIs, Terraform providers, webhooks and alerting are all things Cloudflare offers too, and in its definition none of them amount to programmability. The test it proposes is whether arbitrary logic you wrote for your own environment runs inline, where the security decision happens.