Cloudflare Gateway: User-coded traffic processing, data leak detection validation

1. Traffic processing and detection validation have different release schedules

In the October 15, 2026 announcement, the Forward action, which sends traffic to code, launched in public beta. Custom Function, which computes policy conditions, is planned for release before the end of 2026. Both features are planned for all plans at general availability.

Separately, custom validation functions for data loss prevention (DLP) are available from the announcement date. The availability of policy condition creation must be distinguished from that of detection result validation.

2. Choose between modifying requests and supplying inputs for decisions

Forward applies to traffic allowed by web request policies, and the first matching forwarding rule sends the request to the linked Worker. The Worker receives and can modify request headers and bodies, as well as the origin server's response. It can also perform only asynchronous tasks, such as notifications, without modifying requests.

By contrast, Custom Function runs during policy evaluation and returns a string, number, or boolean. It is a calculator supplying values for decisions, not a workbench for modifying requests. Its return value is compared with other conditions in the policy editor.

The information a function receives depends on the policy stage. It can use user identity, device security posture, and connection information. This makes it applicable not only to HTTP but also to arbitrary ports and protocols in network policies.

3. Return role information as a policy condition

The following custom function comes from the original article. It decodes a token from the request's authorization header and returns the first group value. This value can serve as an allow-rule condition, but the example does not include token signature verification.

export class GatewayCustomSelector extends WorkerEntrypoint {
  async compute(ctx: GatewayContext): Promise<string> {
    const authHeader = ctx.request.headers.get("Authorization");
    if (!authHeader) return "anonymous";

    const token = authHeader.replace("Bearer ", "");
    const payload = JSON.parse(atob(token.split(".")[1]));
    return payload.groups?.[0] ?? "unknown";
  }
}

Another use case is displaying a justification form when users access sensitive destinations. Whether a user has submitted it is recorded in storage with an expiration, so they are asked only once per configured period. The user and justification are stored in a database for audit records.

4. Check actual validity after a pattern match

DLP detection using regular expressions and word lists finds patterns resembling sensitive information. It does not establish whether that data is relevant to an actual leak or misuse. Exact data matching also requires customers to prepare, maintain, and supply a reference dataset.

Custom validation functions run customer validation logic after a detection entry matches but before policy enforcement. For example, when a GitHub secret is detected, a function can query the key's status and decide whether the detection matches based on whether the key is active. This adds a step after pattern inspection to check whether the key is actually usable.

5. Infrastructure burdens shrink, but code design remains a responsibility

Gateway handles connections, encryption, and certificate management, letting customer code focus on transformation logic. Code that processes live requests must instead be narrowly scoped to avoid harming the user experience. Custom policy functions suit fast, bounded, stateless evaluation. Each function needs a defined fallback behavior and a default return value.

Cloudflare says the gateway and code execution service run on the same machines, so calls add no network hop and performance impact is limited to code execution time. No specific latency measurements were provided.

Forwarded traffic is billed as standard Workers requests. The free plan is also available, but execution time and daily request limits need to be considered when increasing throughput.

The value of this change lies in reducing separate proxies while incorporating organization-specific decisions into security policies, at the cost of designing and running customer code.