Index of every page on this site: llms.txt
All skills
cloudflare avatar

/gateway-workers

@86505e4 official
by cloudflarecloudflare/skills3.1k stars
315
Run it yourself

Build, debug, or review Cloudflare Workers invoked by the Forward action in Gateway HTTP policies, including the GatewayMiddleware entrypoint, Gateway types, context, and continuation.

Use this Skill: https://skilld.dev/gh/cloudflare/skills/gateway-workers

Nothing lands on disk. Nothing to clean up.

Fork this Skill

Edit a local copy. It keeps the author and licence.

SKILL.md

≈50 tokens for metadata: the name and description. ≈1.1k when used: this file.

Description uses 2.5% of example budget

Before choosing a Skill, your Agent reads its name and description. All available Skills share that space.

  • A shorter description leaves more room for other Skills. This entry exceeds our 1% size suggestion.

In our Claude Code example, all Skill names and descriptions share 8,000 characters. This Skill uses ≈202 characters, or 2.5%.

The 1% threshold is a size suggestion. Longer descriptions can still fit.

Your model, settings, and other Skills decide how much text your Agent can read.

Example settings and source

The example uses a 200k-token context and default Claude Code settings. The count includes the name, description, separators, and when_to_use when present. Codex also counts local file paths.

Skit's source and limits: Codex 0.160.1, Claude Code 2.1.292.

Gateway Workers

Read the current Forward guide before implementing a Worker. It defines how Gateway invokes Workers on permitted HTTP traffic. Retrieve the relevant page below rather than copying setup, API payloads, or limits into the project from memory.

Workflow

  1. Inspect the existing Worker and choose a Worker template for the required transformation, synthetic response, or background task.
  2. Export a named GatewayMiddleware class extending WorkerEntrypoint from cloudflare:workers. Implement handle(request, context, next) and return a Response. Gateway calls this method through RPC. A default fetch() handler alone does not implement the Forward contract.
  3. For TypeScript, follow the chosen template's current package installation and type-import instructions.
  4. Use the second argument for Gateway context. It describes the original request and stays unchanged when the Worker modifies the request. Keep it distinct from this.ctx (Workers execution context) and this.env (bindings).
  5. Continue the user's request with next(request) at most once, or return a synthetic response without calling it. next() always targets the original destination. Changes to the destination URL or host are ignored, and it cannot redirect, retry, or fan out. Use fetch() to send a request to a different destination. It creates an independent subrequest that does not inherit the user's Gateway policies or egress configuration.

Context

Use the published types and context reference for field names and availability. Treat a falsy identity (!identity) as anonymous and guard optional posture values. Call await context.identity() or await context.devicePosture() only when needed. Both getters can reject. Catch lookup failures separately from missing values and decide how to handle each when the Worker depends on them. Use Gateway-provided identity rather than client-supplied identity headers.

Gateway behavior

  • Only the first matching Forward policy invokes a Worker. Worker invocation does not confirm successful body inspection. Follow the Forward guide's inspection order.
  • Gateway inspects the final response, including synthetic responses. Modified request bytes are not inspected again before reaching the origin.
  • Review the Forward guide's limitations before choosing traffic: HTTPS requires decryption, WebSockets bypass the Worker, and matching Workers VPC traffic is dropped. Worker invocation failures fail closed.

Validation

Type-check against the installed Gateway types and test the named RPC entrypoint, including zero or one continuation call and the context values the Worker uses. Then test a permitted request through a scoped Gateway Forward policy. A direct request to a default fetch() handler does not validate the Gateway path. Follow the chosen template's test procedure and the Forward guide's troubleshooting steps.

Check the response and streaming rules: return a final status from 200 to 599, return no body for HEAD requests or statuses 204, 205, and 304, and stream bodies rather than buffering them.

Related skills

  • cloudflare-one: Gateway policy design, traffic paths, identity, TLS, and rollout.
  • workers-best-practices: streaming, bindings, generated environment types, background work, observability, and runtime tests.
  • CLI selection: choose the existing cf-cli or wrangler skill for project setup and deployment.

Source: SKILL.md on GitHub

Skill behaviors

skilld matched fixed text patterns in SKILL.md and file names. Patterns miss obfuscated code.

skilld run checks every file with the same patterns. It asks for approval before it loads a Skill with a behavior marked Needs approval.

Third-party checks

No alertstoday3 checks · Risk SAFE
  • Gen Agent Trust Hubtoday

    This skill provides instructions for developing Cloudflare Gateway Workers. It includes considerations for handling external request data, which is a standard part of middleware development. All external references point to the official vendor documentation for implementation guidance.

  • Sockettoday

    No alerts

  • Snyktoday

    Risk: LOW · No issues

Provenance

Signed by skilld at 86505e4. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 13 hours ago.

Activeupdated 19 hours ago

README badge

README badge for cloudflare/skills/gateway-workers