Moving from license plates to badges: the Gateway Authorization Proxy (opens in new tab)
Cloudflare’s Gateway Authorization Proxy extends identity-based traffic protection to devices where the Cloudflare One Client cannot be installed. It replaces IP-based identification with browser-based authentication, allowing organizations to apply user-specific policies and maintain visibility across unmanaged endpoints. The solution is especially suited to VDI, acquisitions, and regulated environments, while the One Client remains preferable for fully managed devices. ## Limitations of IP-Based Proxy Access - Earlier proxy endpoints identified users through static IP addresses. - This resulted in: - Logs that showed locations rather than individual users. - Policies breaking when users changed networks. - Manual maintenance of self-hosted Proxy Auto-Configuration (PAC) files. ## Gateway Authorization Proxy - The proxy authenticates users through a Cloudflare Access-style login before applying Gateway filtering. - Organizations can: - Attribute proxy traffic and logs to specific users. - Create granular rules, such as restricting accounting tools to the Finance team. - Offer one or multiple identity providers, including Okta and Azure AD. - Use a familiar per-user seat-based billing model. ## Cookie-Based Identity Tracking - The proxy uses signed JWT cookies to associate a user with requests. - On the first visit to a domain: - The proxy checks for a domain-specific identity cookie. - If none exists, it redirects the user to Cloudflare Access. - Existing Access sessions can issue a domain-specific token immediately. - Otherwise, the user authenticates through the configured identity provider. - Once established, the cookie authorizes later requests to that domain and its subdomains without further redirects. - Cloudflare’s edge network makes the authentication flow effectively invisible to users. - Access can be revoked quickly without installing software on the endpoint. ## Cloud-Hosted PAC Files - Cloudflare now hosts PAC files, removing the need for customers to operate their own hosting. - Starter templates simplify initial configuration. - Cloudflare’s AI assistant, Cloudy, can summarize PAC file behavior so administrators do not need to inspect the code manually. ## Best-Fit Use Cases - **Virtual desktop infrastructure:** Browser traffic from managed or shared virtual machines. - **Mergers and acquisitions:** Rapidly bringing users from different organizations under common security policies. - **Compliance-constrained environments:** Devices where endpoint software installation is prohibited. - The Cloudflare One Client is still recommended when deeper device control and the best user experience are possible. The Gateway Authorization Proxy is a practical alternative for securing unmanaged devices: use the One Client for fully managed endpoints, and browser-based authorization when identity and policy enforcement must happen without endpoint installation.