Gateway HTTP policies now support advanced header control
Cloudflare Gateway now allows administrators to add, overwrite, or delete HTTP headers on Allow policies using static values or dynamic variables like user identity and device context. This enables fine-grained control over request headers based on identity, device, and network attributes.
Cloudflare Gateway now supports advanced header control on Allow policies. Administrators can add, overwrite, or delete headers on matching requests using static values or dynamic variables.
Header operations
Gateway HTTP policies using the Allow action support three operations in rule_settings:
| Operation | API field | Behavior |
|---|---|---|
| Add | add_headers |
Appends a value to the header. Existing values are preserved. |
| Overwrite | set_headers |
Replaces the header value. Creates the header if it does not exist. |
| Delete | delete_headers |
Removes the header from the request. |
Gateway applies operations in order: delete, then overwrite, then add.
Dynamic variables
Header values can include dynamic variables using the @{...} syntax. Gateway resolves variables at request time from identity, device, and network context.
| Variable | Description |
|---|---|
@{identity.email} |
User email from the identity provider |
@{identity.name} |
User display name from the identity provider |
@{identity.id} |
Cloudflare identity UUID |
@{identity.groups} |
Identity provider group memberships |
@{identity.SAML} |
SAML attributes (if configured) |
@{identity.OIDC} |
OIDC claims (if configured) |
@{source.ip} |
Source IP of the connection |
@{destination.ip} |
Destination IP of the request |
@{device.id} |
Cloudflare One Client device UUID |
@{device.posture} |
Device posture check results (JSON string) |
You can mix static text and dynamic variables in a single header value. For example, user-@{identity.email} resolves to user-jdoe@example.com.
For more information, refer to Custom headers.
Source: original entry ↗