Cloudflare Unlocks True Programmability for Secure Web Gateway and DLP
Cloudflare announced a significant enhancement to its secure web gateway and data loss prevention (DLP) services, integrating them with Cloudflare Workers for unprecedented customization and inline policy evaluation.
Cloudflare has introduced a new level of programmability for its secure web gateway and Data Loss Prevention (DLP) services, allowing customers to execute custom code directly within the policy evaluation path. This integration with Cloudflare Workers means that arbitrary logic can now be applied inline, enabling sophisticated traffic manipulation and data validation at the edge, a capability that traditional secure web gateways have struggled to provide.
The move addresses a long-standing trade-off in network security: the choice between maintaining complex, in-house security infrastructure for maximum customization or accepting vendor limitations in exchange for reduced maintenance overhead. Cloudflare's approach aims to eliminate this compromise by enabling customers to run their own code directly on Cloudflare's global network.
Historically, secure web gateways have operated on a simple model of matching traffic to predefined conditions and applying terminal actions like 'Allow' or 'Block.' While effective for common scenarios, this model hits a ceiling for organizations with unique or complex security requirements. Cloudflare cites examples such as needing to inject custom HTTP headers based on JSON Web Token (JWT) claims or requiring immediate Slack notifications for specific SaaS sign-ups, tasks that often necessitate standing up and managing separate proxy infrastructure.
Cloudflare argues that its unique position as a composable compute platform, running both its edge security services and Cloudflare Workers on the same global infrastructure, allows for this deep integration. Unlike other vendors who might offer APIs or webhooks, Cloudflare enables code execution directly alongside security policy evaluation, eliminating the latency and complexity associated with stitching together disparate systems.
Two key entry points for this new programmability are the 'Forward' action and 'Custom Functions.' The 'Forward' action, now in public beta, allows matched HTTP requests to be routed to a Cloudflare Worker, which acts as inline middleware. This Worker receives the full request headers and body, enabling transformations and manipulations before the traffic proceeds.
'Custom Functions,' expected later this year, will offer another distinct method for invoking Workers from Gateway policies. These functions will allow security teams to bring their own data and logic to the policy evaluation process, further enhancing the granularity and specificity of security controls.
This enhanced programmability is designed to provide security teams with greater agility and flexibility in an era of rapidly evolving threats. By allowing custom code to run at the edge, Cloudflare aims to empower organizations to build highly tailored security solutions that can adapt to their specific environments and the dynamic threat landscape without the burden of managing additional infrastructure.
The integration is available to all Cloudflare Zero Trust customers, signifying a significant step towards a truly programmable Secure Access Service Edge (SASE) platform. The company emphasizes that the co-location of compute and security gateway functions on its edge network provides a distinct advantage, enabling near-zero latency for these custom security operations.