Cloudflare Gateway Now Lets You Rewrite HTTP Headers Freely!

Hi, I'm Shii-chan! Today I found a nice quality-of-life update for Cloudflare Gateway policies, so let's dive in.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to Cloudflare's Changelog, Gateway HTTP policies using the Allow action can now add, overwrite, or delete headers on matching requests. Header values can be plain static text, or dynamic variables that pull details from the user's identity, device, and network context.

The story so far

Until now, Allow policies were mostly about deciding whether to let a request through or not — they didn't give you a built-in way to shape the headers themselves. If you wanted to pass identity or device details along to a backend, you'd typically need to wire that up somewhere else, outside the policy.

What changes

Now you can build headers entirely from Gateway policy settings. For example, you could automatically stamp "who accessed this" onto requests forwarded to an internal system, or strip out a header you don't want leaking downstream. For anyone running a Zero Trust setup, this means less backend code and more policy-driven control.

Dive Deep

rule_settings supports three operations:

• Add (add_headers) — appends a value to the header; existing values are preserved
• Overwrite (set_headers) — replaces the header value, creating the header if it doesn't exist
• Delete (delete_headers) — removes the header from the request

When you combine them, Gateway applies operations in this order: delete, then overwrite, then add. Keeping that order in mind helps you predict the final result.

Header values can also include dynamic variables using @{...} syntax:

• @{identity.email} — the email of the authenticated user
• @{identity.name} — the user's display name
• @{identity.id} — the Cloudflare identity UUID
• @{identity.groups} — the identity provider's group memberships
• @{identity.SAML} — SAML attributes
• @{identity.OIDC} — OIDC claims
• @{source.ip} — the source IP of the connection
• @{destination.ip} — the destination IP of the request
• @{device.id} — the Cloudflare One Client device UUID
• @{device.posture} — the device posture check result

You can mix static text with variables too. The docs give this example:

user-@{identity.email}

which resolves to something like user-jdoe@example.com. That's a handy way to generate a unique, per-user header value from a single policy.

Wrap-up

• Gateway Allow policies can now add, overwrite, or delete headers
• Three operations are available: add_headers, set_headers, delete_headers
• Operations apply in this order: delete, then overwrite, then add
• Dynamic variables like @{identity.email} and @{source.ip} pull in identity, device, and network context
• You can combine static text with variables to build per-user header values automatically

If you've been wanting to pass identity details into backend requests without touching application code, this one's worth trying out.