Gateway - New header control options for Gateway HTTP policies

<p>Cloudflare Gateway now supports advanced header control on <a href="https://developers.cloudflare.com/cloudflare-one/traffic-policies/http-policies/#allow">Allow policies</a>. Administrators can add, overwrite, or delete headers on matching requests using static values or dynamic variables.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="header-operations">Header operations</h4><a class="anchor-link" href="#header-operations"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>Gateway HTTP policies using the Allow action support three operations in <code>rule_settings</code>:</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>Operation</th> <th>API field</th> <th>Behavior</th> </tr> </thead> <tbody> <tr> <td>Add</td> <td><code>add_headers</code></td> <td>Appends a value to the header. Existing values are preserved.</td> </tr> <tr> <td>Overwrite</td> <td><code>set_headers</code></td> <td>Replaces the header value. Creates the header if it does not exist.</td> </tr> <tr> <td>Delete</td> <td><code>delete_headers</code></td> <td>Removes the header from the request.</td> </tr> </tbody> </table></div> <p>Gateway applies operations in order: delete, then overwrite, then add.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="dynamic-variables">Dynamic variables</h4><a class="anchor-link" href="#dynamic-variables"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>Header values can include dynamic variables using the <code>@{...}</code> syntax. Gateway resolves variables at request time from identity, device, and network context.</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>Variable</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><code>@{identity.email}</code></td> <td>User email from the identity provider</td> </tr> <tr> <td><code>@{identity.name}</code></td> <td>User display name from the identity provider</td> </tr> <tr> <td><code>@{identity.id}</code></td> <td>Cloudflare identity UUID</td> </tr> <tr> <td><code>@{identity.groups}</code></td> <td>Identity provider group memberships</td> </tr> <tr> <td><code>@{identity.SAML}</code></td> <td>SAML attributes (if configured)</td> </tr> <tr> <td><code>@{identity.OIDC}</code></td> <td>OIDC claims (if configured)</td> </tr> <tr> <td><code>@{source.ip}</code></td> <td>Source IP of the connection</td> </tr> <tr> <td><code>@{destination.ip}</code></td> <td>Destination IP of the request</td> </tr> <tr> <td><code>@{device.id}</code></td> <td>Cloudflare One Client device UUID</td> </tr> <tr> <td><code>@{device.posture}</code></td> <td>Device posture check results (JSON string)</td> </tr> </tbody> </table></div> <p>You can mix static text and dynamic variables in a single header value. For example, <code>user-@{identity.email}</code> resolves to <code>user-jdoe@example.com</code>.</p> <p>For more information, refer to <a href="https://developers.cloudflare.com/cloudflare-one/traffic-policies/http-policies/tenant-control/">Custom headers</a>.</p>