Workers, BYOIP, Bots - Workers subrequests now preserve context for BYOIP destinations

<p>Cloudflare now preserves Workers context when a subrequest targets a Cloudflare-proxied hostname using <a href="https://developers.cloudflare.com/byoip/">Bring Your Own IP (BYOIP)</a>. These requests are identified as Cloudflare-to-Cloudflare traffic instead of external Internet traffic.</p> <p>Previously, some BYOIP subrequests could lose Workers context and original client signals. This could cause security rules to behave unexpectedly, Bot Management to evaluate an internal Cloudflare connection instead of the original client, or affected requests to return false <code>403</code> responses.</p> <p>Workers subrequests to BYOIP destinations now preserve the <a href="https://developers.cloudflare.com/fundamentals/reference/http-headers/#cf-worker"><code>CF-Worker</code></a> header and <a href="https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.worker.upstream_zone/"><code>cf.worker.upstream_zone</code></a> field. This supports consistent security rule evaluation across same-zone and cross-zone subrequests.</p> <p><a href="https://developers.cloudflare.com/bots/reference/bot-management-variables/#o2o-and-subrequests">Bot Management fields</a> on the destination zone now represent the original end-user connection for affected BYOIP subrequests. Bot scores, verified bot status, and JA3/JA4 fingerprints no longer represent the internal connection between Cloudflare services.</p> <p>Because Cloudflare-proxied BYOIP destinations now follow standard Workers subrequest handling, cross-zone requests set <a href="https://developers.cloudflare.com/fundamentals/reference/http-headers/#cf-connecting-ip-in-worker-subrequests"><code>CF-Connecting-IP</code></a> to the Workers client IP address <code>2a06:98c0:3600::103</code> for security reasons. This applies when a Worker in one Cloudflare zone sends a subrequest to a hostname in another Cloudflare zone. Same-zone subrequests continue to reflect the client IP through <code>CF-Connecting-IP</code>.</p> <p>For more information, refer to <a href="https://developers.cloudflare.com/byoip/">Cloudflare BYOIP</a>, <a href="https://developers.cloudflare.com/workers/platform/limits/#subrequests">Workers subrequests</a>, and <a href="https://developers.cloudflare.com/fundamentals/reference/http-headers/#cf-connecting-ip-in-worker-subrequests"><code>CF-Connecting-IP</code> in Worker subrequests</a>.</p>