New header control options for Gateway HTTP policies

Cloudflare Gateway now supports advanced header control on Allow policies. Administrators can add, overwrite, or delete headers on matching requests using static values or dynamic variables.

Header operations

Gateway HTTP policies using the Allow action support three operations in rule_settings:

Operation · API field · Behavior

Add · add_headers · Appends a value to the header. Existing values are preserved.

Overwrite · set_headers · Replaces the header value. Creates the header if it does not exist.

Delete · delete_headers · Removes the header from the request.

Gateway applies operations in order: delete, then overwrite, then add.

Dynamic variables

Header values can include dynamic variables using the @{...} syntax. Gateway resolves variables at request time from identity, device, and network context.

Variable · Description

@{identity.email} · User email from the identity provider

@{identity.name} · User display name from the identity provider

@{identity.id} · Cloudflare identity UUID

@{identity.groups} · Identity provider group memberships

@{identity.SAML} · SAML attributes (if configured)

@{identity.OIDC} · OIDC claims (if configured)

@{source.ip} · Source IP of the connection

@{destination.ip} · Destination IP of the request

@{device.id} · Cloudflare One Client device UUID

@{device.posture} · Device posture check results (JSON string)

You can mix static text and dynamic variables in a single header value. For example, user-@{identity.email} resolves to user-jdoe@example.com.

For more information, refer to Custom headers.