--- title: A fully programmable secure web gateway | daily.dev description: Cloudflare is adding true programmability to Cloudflare Gateway and DLP by integrating them with Cloudflare Workers running on the same edge infrastructure.... canonical: https://daily.dev/posts/a-fully-programmable-secure-web-gateway-k6jd0sivs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A fully programmable secure web gateway | daily.dev og:description: Cloudflare is adding true programmability to Cloudflare Gateway and DLP by integrating them with Cloudflare Workers running on the same edge infrastructure.... og:url: https://daily.dev/posts/a-fully-programmable-secure-web-gateway-k6jd0sivs og:image: https://api.daily.dev/og/posts/k6jD0sIVs.png og:image:alt: A fully programmable secure web gateway og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A fully programmable secure web gateway **[Cloudflare](https://daily.dev/sources/cloudflare)** · 14 min read · 0 upvotes · 0 comments ## Summary Cloudflare is adding true programmability to Cloudflare Gateway and DLP by integrating them with Cloudflare Workers running on the same edge infrastructure. Two new entry points are introduced: a Forward action, which routes matched HTTP traffic to a Worker for inline transformation, logging, or alerting, and Custom Functions, which let a Worker return a typed value used as a selector in policy conditions (e.g., parsing JWTs to extract roles). Because Gateway and Workers share the same machines, dispatching to a Worker is a local function call with no added network hop. Use cases include dynamic header injection, interstitial justification pages, file inspection, real-time Slack/PagerDuty alerting, and DLP custom validation functions that verify whether detected data (like GitHub secrets) is actually active before triggering a policy. Forward is in public beta now; Custom Functions and DLP custom validation are rolling out before year-end, available across all Zero Trust and Workers plans with usage billed as standard Worker requests. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Cloudflare's new Forward action in Gateway work with Workers? The Forward action routes HTTP traffic matched by a Gateway policy to a bound Cloudflare Worker, which acts as inline middleware receiving full headers and request body. The Worker can modify the request, forward it to the origin, modify the response, and return it, or simply proxy the request asynchronously for logging or alerting while traffic continues unbothered. Gateway handles TCP, TLS, and certificate management; the Worker only runs transformation logic. _Teams weighing how to extend a secure web gateway without new infrastructure can track Cloudflare's rollout on daily.dev._ ### What are Custom Functions in Cloudflare Gateway and how do they differ from the Forward action? Custom Functions call a Worker inline during Gateway policy evaluation and return a typed value (string, number, or boolean) used as a selector in rule conditions, such as parsing a JWT to extract a user's role. Unlike the Forward action, which transforms live HTTP traffic as middleware, Custom Functions are meant for quick, bounded, stateless evaluations that feed into policy decisions rather than manipulating the traffic itself. _Architects comparing policy-evaluation extension points can follow these Gateway updates on daily.dev._ ### How can I verify that a GitHub secret detected by a DLP scanner is still active before triggering a policy? A custom DLP validation function can be dispatched when a detection entry matches, calling the GitHub API (e.g., GET /user with the detected token as a Bearer credential) to check validity before enforcement. A 200 response scores the match as high-confidence (1.0), a 401 vetoes it as invalid and discards the match, and other outcomes default to a score of 0, avoiding false positives on dead credentials. _Security teams tuning DLP accuracy for leaked secrets can follow this validation pattern via daily.dev._ ## Similar posts on daily.dev - [The truly programmable SASE platform](https://daily.dev/posts/the-truly-programmable-sase-platform-lkcrtyqma) · Cloudflare · 0 upvotes · 0 comments - [Modular Edge Computing at Multi-Tenant SaaS Scale on Cloudflare Workers](https://daily.dev/posts/modular-edge-computing-at-multi-tenant-saas-scale-on-cloudflare-workers-zgtnvgdda) · InfoQ · 0 upvotes · 0 comments - [Cloudflare Workers: your first serverless function](https://daily.dev/posts/cloudflare-workers-your-first-serverless-function-zkqoxjdgf) · Flavio Copes · 0 upvotes · 0 comments - [Edge Functions vs Serverless 2026: The Honest Truth](https://daily.dev/posts/edge-functions-vs-serverless-2026-the-honest-truth-tjktppggt) · Alex CloudStar · 0 upvotes · 0 comments --- Tags: [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/a-fully-programmable-secure-web-gateway-k6jd0sivs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A fully programmable secure web gateway","url":"https://daily.dev/posts/a-fully-programmable-secure-web-gateway-k6jd0sivs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-fully-programmable-secure-web-gateway-k6jd0sivs"},"datePublished":"2026-10-15T17:11:40.462Z","dateModified":"2026-10-15T17:13:44.016Z","description":"Cloudflare is adding true programmability to Cloudflare Gateway and DLP by integrating them with Cloudflare Workers running on the same edge infrastructure....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/017fb848aa5d8814c38b6eda9e7b025e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/017fb848aa5d8814c38b6eda9e7b025e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-fully-programmable-secure-web-gateway-k6jd0sivs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloudflare","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"A fully programmable secure web gateway"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-fully-programmable-secure-web-gateway-k6jd0sivs#faq","mainEntity":[{"@type":"Question","name":"How does Cloudflare's new Forward action in Gateway work with Workers?","acceptedAnswer":{"@type":"Answer","text":"The Forward action routes HTTP traffic matched by a Gateway policy to a bound Cloudflare Worker, which acts as inline middleware receiving full headers and request body. The Worker can modify the request, forward it to the origin, modify the response, and return it, or simply proxy the request asynchronously for logging or alerting while traffic continues unbothered. Gateway handles TCP, TLS, and certificate management; the Worker only runs transformation logic. Teams weighing how to extend a secure web gateway without new infrastructure can track Cloudflare's rollout on daily.dev."}},{"@type":"Question","name":"What are Custom Functions in Cloudflare Gateway and how do they differ from the Forward action?","acceptedAnswer":{"@type":"Answer","text":"Custom Functions call a Worker inline during Gateway policy evaluation and return a typed value (string, number, or boolean) used as a selector in rule conditions, such as parsing a JWT to extract a user's role. Unlike the Forward action, which transforms live HTTP traffic as middleware, Custom Functions are meant for quick, bounded, stateless evaluations that feed into policy decisions rather than manipulating the traffic itself. Architects comparing policy-evaluation extension points can follow these Gateway updates on daily.dev."}},{"@type":"Question","name":"How can I verify that a GitHub secret detected by a DLP scanner is still active before triggering a policy?","acceptedAnswer":{"@type":"Answer","text":"A custom DLP validation function can be dispatched when a detection entry matches, calling the GitHub API (e.g., GET /user with the detected token as a Bearer credential) to check validity before enforcement. A 200 response scores the match as high-confidence (1.0), a 401 vetoes it as invalid and discards the match, and other outcomes default to a score of 0, avoiding false positives on dead credentials. Security teams tuning DLP accuracy for leaked secrets can follow this validation pattern via daily.dev."}}]} ```