Cloudflare Gateway: Inline Workers Proxy & Programmable DLP
Cloudflare has integrated Cloudflare Gateway and Data Loss Prevention (DLP) directly with Cloudflare Workers across 330+ edge locations, enabling zero-hairpinning inline HTTP mutation and live programmatic DLP secret verification.
For nearly 30 years, enterprise secure web gateways (SWGs) have been constrained by static policy engines: traffic matches a rule and triggers a fixed terminal action (Allow, Block, Isolate, or Log). On October 15, 2026, Cloudflare announced the full integration of Cloudflare Gateway and Data Loss Prevention (DLP) with the Cloudflare Workers serverless compute platform across all Zero Trust tiers.
Co-Located Edge Compute with Zero Network Hairpinning
When enterprise security teams needed custom traffic transformations, such as extracting JSON Web Token (JWT) identity claims to inject custom upstream HTTP headers, they historically had to maintain separate NGINX proxy fleets or route webhooks across external clouds. Because Cloudflare Gateway and Cloudflare Workers run on the exact same physical machines across 330+ global locations, dispatching traffic from a Gateway policy to a Worker executes as an in-memory local function call with zero network hairpinning.
Inline Forward Proxies and Programmatic DLP Token Verification
The release introduces two programmable extensibility primitives for security engineering teams:
- Gateway Forward Action (Public Beta): Routes matched HTTP requests through a Worker extending the GatewayMiddleware entrypoint, allowing inline mutation of request headers, payload sanitization, asynchronous Slack/SIEM alerting, or interactive user justification prompts.
- DLP Custom Functions (DlpValidationEntrypoint): Executes custom TypeScript validation logic whenever a regex or predefined DLP detector matches candidate strings in transit.
- Live Credential Verification: Instead of blocking traffic on noisy regex matches alone, a DLP Custom Function can query external APIs (such as verifying whether a matched ghp_ GitHub token is an active organizational credential) before enforcing a block decision.
“True programmability means running arbitrary logic that you wrote for your specific environment inline in the policy evaluation path, at the exact moment a security decision is made.”
References & Primary Sources
Related Analysis & Context
Cloudflare & OpenAI: Real-Time Signals for Web Discovery
A joint engineering pilot across 1% of Cloudflare's global network enabled OpenAI to discover hundreds of millions of previously unindexed web pages within seconds of publication while cutting redundant crawler polling and 404 traffic.
eBPF Kernel Architecture: XDP, Socket Bypass & Cilium Security
An authoritative cloud-native systems blueprint dissecting the eBPF revolution inside the Linux kernel: the 64-bit register virtual machine, static DAG Verifier safety proofs, native JIT compilation, pre-sk_buff packet processing with eXpress Data Path (XDP), O(1) socket-layer load balancing in Cilium, and synchronous LSM runtime security enforcement with Tetragon.
Cloudflare Radar: Continuous Verified Bot Accountability
Cloudflare has unveiled a continuous behavioral evaluation system that scores whether cryptographically verified bots honor RFC 9309 robots.txt directives and adapt their request rates upon receiving HTTP 429 signals.