Gateway Workers

Read the current Forward guide before implementing a Worker. It defines how Gateway invokes Workers on permitted HTTP traffic. Retrieve the relevant page below rather than copying setup, API payloads, or limits into the project from memory.

Workflow

1. Inspect the existing Worker and choose a Worker template for the required transformation, synthetic response, or background task.
2. Export a named GatewayMiddleware class extending WorkerEntrypoint from cloudflare:workers. Implement handle(request, context, next) and return a Response. Gateway calls this method through RPC. A default fetch() handler alone does not implement the Forward contract.
3. For TypeScript, follow the chosen template's current package installation and type-import instructions.
4. Use the second argument for Gateway context. It describes the original request and stays unchanged when the Worker modifies the request. Keep it distinct from this.ctx (Workers execution context) and this.env (bindings).
5. Continue the user's request with next(request) at most once, or return a synthetic response without calling it. next() always targets the original destination. Changes to the destination URL or host are ignored, and it cannot redirect, retry, or fan out. Use fetch() to send a request to a different destination. It creates an independent subrequest that does not inherit the user's Gateway policies or egress configuration.

Context

Use the published types and context reference for field names and availability. Treat a falsy identity (!identity) as anonymous and guard optional posture values. Call await context.identity() or await context.devicePosture() only when needed. Both getters can reject. Catch lookup failures separately from missing values and decide how to handle each when the Worker depends on them. Use Gateway-provided identity rather than client-supplied identity headers.

Gateway behavior