CF-Incidents Gateway - New header control options for Gateway HTTP policies

[ENF News Bot]

Cloudflare Gateway now supports advanced header control on Allow policies. Administrators can add, overwrite, or delete headers on matching requests using static values or dynamic variables.

Header operations​

https://developers.cloudflare.com/changelog/rss/#header-operations

Gateway HTTP policies using the Allow action support three operations in rule_settings:

Operation	API field	Behavior
Add	add_headers	Appends a value to the header. Existing values are preserved.
Overwrite	set_headers	Replaces the header value. Creates the header if it does not exist.
Delete	delete_headers	Removes the header from the request.

Gateway applies operations in order: delete, then overwrite, then add.

Dynamic variables​

https://developers.cloudflare.com/changelog/rss/#dynamic-variables

Header values can include dynamic variables using the @{...} syntax. Gateway resolves variables at request time from identity, device, and network context.

Variable	Description
@{identity.email}	User email from the identity provider
@{identity.name}	User display name from the identity provider
@{identity.id}	Cloudflare identity UUID
@{identity.groups}	Identity provider group memberships
@{identity.SAML}	SAML attributes (if configured)
@{identity.OIDC}	OIDC claims (if configured)
@{source.ip}	Source IP of the connection
@{destination.ip}	Destination IP of the request
@{device.id}	Cloudflare One Client device UUID
@{device.posture}	Device posture check results (JSON string)

You can mix static text and dynamic variables in a single header value. For example, user-@{identity.email} resolves to user-jdoe@example.com.

For more information, refer to Custom headers.

Continue reading...