Cloudflare has updated the request handling for Workers subrequests that address a hostname served via Bring Your Own IP (BYOIP). The platform now forwards the CF-Worker header and the cf.worker.upstream_zone field, preserving the original client context across the internal Cloudflare‑to‑Cloudflare hop. Practitioners who rely on Workers for request orchestration, security rule evaluation, or bot detection should note that the change eliminates a class of false negatives and spurious 403 responses that previously occurred when that context was dropped.
What Changed in the Request Path
Earlier, subrequests to BYOIP‑enabled hostnames could be re‑classified as external Internet traffic, causing the Workers runtime to strip the CF-Worker header and the upstream zone identifier. The new behavior treats these calls as internal Cloudflare traffic, retaining both identifiers so downstream services receive the same metadata they would from a direct client request.
Impact on Security Rules and Bot Management
Security rule engines and Bot Management rely on client‑derived signals such as bot scores, verified‑bot status, and JA3/JA4 fingerprints. With the context now preserved, those fields on the destination zone reflect the original end‑user connection rather than the internal Cloudflare link. Consequently, rule conditions that depend on cf.worker.upstream_zone or Bot Management variables will evaluate consistently whether the request originates from the same zone or crosses zones via BYOIP.
Operational Considerations
- Deployment is automatic; no changes to Workers scripts, firewall rules, or Bot Management settings are required.
- Existing monitoring that flags unexpected 403 responses from BYOIP subrequests should see a reduction in noise.
- Teams should verify that any custom logging that previously captured missing
CF-Workerheaders now records the expected values. - Because the change is transparent, there is no need to adjust rate‑limiting or caching policies solely for BYOIP traffic.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Engineers should treat BYOIP subrequests as fully context‑aware, allowing security policies and bot detection logic to operate without special exceptions. Review existing Workers scripts for any conditional handling of missing CF-Worker data and simplify where possible. Monitor Bot Management dashboards for a shift toward more accurate scores on BYOIP traffic, and confirm that false 403 incidents have ceased. The change improves reliability of cross‑zone orchestration and reduces the operational overhead of troubleshooting context‑loss issues.