Use Cloudflare Workers to add your own logic to HTTP traffic that passes through Gateway. A Gateway HTTP policy with the Forward action sends matching, permitted traffic to a Worker in your account. The Worker can modify a request, transform a response, return its own response, or start background work such as a notification or an R2 write. You can write your own Worker for your use case or adapt a Worker template.
Gateway handles the proxy connection, TLS decryption, and upstream routing. Your Worker receives standard Request and Response objects and Gateway context about the connection, policy, and user.
Gateway evaluates HTTP request policies before Forward policies. Body policies and inspection run after Worker invocation and can interrupt the Worker if they block the request.
A Forward policy does not override a Block policy or replace Gateway inspection. Refer to How Forward works for the request and response inspection order.
WebSocket traffic connects directly to the original upstream service and bypasses the Worker. Refer to Known limitations for protocol restrictions and other constraints.
- Forward traffic: Deploy a Worker and select it in a Gateway HTTP policy.
- Available context: Read connection metadata, user identity, and device posture.
- Worker templates: Start with a small script for notifications, capture, or content transformation.
The gateway-workers skill ↗︎ provides guidance for coding agents building or reviewing Workers used in Forward policies.