techlist.io
KREN
cloudflare

Moving from license plates to badges: the Gateway Authorization Proxy (opens in new tab)

cloudflarejwtidentity-managementproxy-configurationvirtual-desktopsdetailed-loggingmulti-identity-providers

Cloudflare’s Gateway Authorization Proxy extends identity-based traffic protection to devices where the Cloudflare One Client cannot be installed. It replaces IP-based identification with browser-based authentication, allowing organizations to apply user-specific policies and maintain visibility across unmanaged endpoints. The solution is especially suited to VDI, acquisitions, and regulated environments, while the One Client remains preferable for fully managed devices.

Limitations of IP-Based Proxy Access

  • Earlier proxy endpoints identified users through static IP addresses.
  • This resulted in:
    • Logs that showed locations rather than individual users.
    • Policies breaking when users changed networks.
    • Manual maintenance of self-hosted Proxy Auto-Configuration (PAC) files.

Gateway Authorization Proxy

  • The proxy authenticates users through a Cloudflare Access-style login before applying Gateway filtering.
  • Organizations can:
    • Attribute proxy traffic and logs to specific users.
    • Create granular rules, such as restricting accounting tools to the Finance team.
    • Offer one or multiple identity providers, including Okta and Azure AD.
    • Use a familiar per-user seat-based billing model.

Cookie-Based Identity Tracking

  • The proxy uses signed JWT cookies to associate a user with requests.
  • On the first visit to a domain:
    • The proxy checks for a domain-specific identity cookie.
    • If none exists, it redirects the user to Cloudflare Access.
    • Existing Access sessions can issue a domain-specific token immediately.
    • Otherwise, the user authenticates through the configured identity provider.
  • Once established, the cookie authorizes later requests to that domain and its subdomains without further redirects.
  • Cloudflare’s edge network makes the authentication flow effectively invisible to users.
  • Access can be revoked quickly without installing software on the endpoint.

Cloud-Hosted PAC Files

  • Cloudflare now hosts PAC files, removing the need for customers to operate their own hosting.
  • Starter templates simplify initial configuration.
  • Cloudflare’s AI assistant, Cloudy, can summarize PAC file behavior so administrators do not need to inspect the code manually.

Best-Fit Use Cases

  • Virtual desktop infrastructure: Browser traffic from managed or shared virtual machines.
  • Mergers and acquisitions: Rapidly bringing users from different organizations under common security policies.
  • Compliance-constrained environments: Devices where endpoint software installation is prohibited.
  • The Cloudflare One Client is still recommended when deeper device control and the best user experience are possible.

The Gateway Authorization Proxy is a practical alternative for securing unmanaged devices: use the One Client for fully managed endpoints, and browser-based authorization when identity and policy enforcement must happen without endpoint installation.