Gateway HTTP policies now support advanced header control

Cloudflare Gateway now supports advanced header control on Allow policies. Administrators can add, overwrite, or delete headers on matching requests using static values or dynamic variables.

Header operations

Gateway HTTP policies using the Allow action support three operations in rule_settings:

Operation	API field	Behavior
Add	add_headers	Appends a value to the header. Existing values are preserved.
Overwrite	set_headers	Replaces the header value. Creates the header if it does not exist.
Delete	delete_headers	Removes the header from the request.

Gateway applies operations in order: delete, then overwrite, then add.

Dynamic variables

Header values can include dynamic variables using the @{...} syntax. Gateway resolves variables at request time from identity, device, and network context.

Variable	Description
@{identity.email}	User email from the identity provider
@{identity.name}	User display name from the identity provider
@{identity.id}	Cloudflare identity UUID
@{identity.groups}	Identity provider group memberships
@{identity.SAML}	SAML attributes (if configured)
@{identity.OIDC}	OIDC claims (if configured)
@{source.ip}	Source IP of the connection
@{destination.ip}	Destination IP of the request
@{device.id}	Cloudflare One Client device UUID
@{device.posture}	Device posture check results (JSON string)

You can mix static text and dynamic variables in a single header value. For example, user-@{identity.email} resolves to user-jdoe@example.com.

For more information, refer to Custom headers.