The most programmable Supercloud with Cloudflare Snippets

Rule-based traffic control, with an escape hatch

Cloudflare's rules products cover a wide range of common traffic operations — setting HTTP headers, rewriting URI paths, and performing redirects. But out-of-the-box functionality has limits. A customer who needs to set a dynamic expiry time based on a cookie, or hash a token with a key, currently has three options: file a feature request and wait, write a full Cloudflare Worker, or push the logic back to origin infrastructure.

Cloudflare Snippets is a new option designed to fill that gap. Snippets let customers perform programmatic traffic modifications that rules can't express, without forcing them onto the Workers platform. And for the vast majority of users, it comes at no extra cost — a high fair usage cap applies, but Snippets will be available at all plan levels.

Why Snippets exist

Over the past 18 months, Cloudflare has shipped Transform Rules, Cache Rules, Origin Rules, Config Rules, and Redirect Rules. These products give customers fine-grained control over how traffic is processed, but they still don't cover every edge case. A small number of use cases remain that rules products simply can't handle — for example, setting dynamic expiry times with cookies or hashing tokens with a key.

Snippets are intended for exactly these situations. Customers no longer need to stand up a Worker for a relatively simple operation, nor wait for a feature request to be built. They can write a short piece of JavaScript and run it in the appropriate rules phase.

Migrating legacy code

Snippets also serve as a migration path for legacy configuration languages. Varnish Control Language (VCL), now about 16 years old, is still used by businesses to configure traffic routing on content delivery networks. While other providers are dropping VCL support, Cloudflare plans to support migration from it.

Snippets won't run pure VCL. Instead, Cloudflare is building a self-serve converter that analyzes uploaded VCL code and auto-generates suggested Snippets. Where a match is found, the converter can also suggest rules for products like Transform Rules or Cache Rules. This builds on Project Turpentine, an internal Cloudflare tool set that parsed customer VCL into JavaScript for Workers — but moves the capability into the dashboard, putting the choice in the user's hands. You can migrate everything possible into rules with the remainder becoming Snippets, or migrate everything into discrete Snippets.

Apache .htaccess and NGINX configuration files will get the same treatment. Users upload their existing configuration files, and Cloudflare generates suggested Snippets and rules where applicable.

How Snippets differ from Workers

Snippets is built on the same platform as Workers, but the execution model is different. A Snippet runs as part of the Ruleset Engine in dedicated new phases, similar to Transform Rules and Cache Rules. Customers can select a Snippet based on any ruleset engine filter — running it against every request, or only for traffic with a certain bot score, originating from a specific country, or carrying a specific cookie. Snippets are additive: one Snippet can add an HTTP header and another can rewrite the URL, and both execute if their filters match.

There are also resource constraints. Snippets are deliberately lightweight relative to Workers, with a 5ms maximum execution time, 2MB maximum memory, and a 32KB total package size. That small footprint is what allows the free tier for 99% of users — and it's sufficient for the target use cases of header modification, URL rewriting, and traffic routing, none of which require the full Workers resource envelope.

What you can build

The migration story is one driver; new use cases are another. A few examples illustrate the range.

Honeypotting suspicious bots

Snippets have access to Cloudflare features available in the Workers runtime, such as the bot score field. A Snippet can forward requests with a bot score of 29 or lower to a honeypot, or use JavaScript's RegExp functions to alter the URL returned to the end user.

…
if (request.cf.botManagement.score < 30) {
const honeypot = "https://example.com/";
return await fetch(honeypot, request);
…
}

Cookie modification

Cookies are another common target. A Snippet can set an expiry five minutes out using getTime and setTime, or set a dynamic cookie based on user request attributes for A/B testing.

…
{
let res = await fetch(request);
res = new Response(res.body, res);
// 24h * 60m * 60s * 1000ms = 86400000ms
const expiry = new Date(Date.now() + 7 * 86400000).toUTCString();
const group = request.headers.get("userGroup") == "premium" ? "A" : "B";
res.headers.append(
      "Set-Cookie",
`testGroup=${group}; Expires=${expiry}; path=/`
    );
…

Selective query string edits

Transform Rules handle query string manipulation with a set/ action that behaves as a replace — it removes the existing value and overwrites it. That makes selective injection difficult. With a Snippet, customers can remove or insert individual query parameters without clobbering the whole string, for instance appending ?utm_campaign=facebook when a social media platform is detected in the user agent.

…
if (userAgent.includes("Facebook")) {
      const url = new URL(request.url);
      const params = new URLSearchParams(url.search);
      params.set("utm_campaign", "facebook");
      url.search = params.toString();
      const transformedRequest = new Request(url, request)
…
}

Rules are not going away

Cloudflare will continue building no-code actions within the ruleset engine. Snippets and rules are complementary, not competing. Feedback from Snippet users will help identify feature gaps — gaps that may justify productizing a use case as a new rules action, or may remain territory for code. For non-developers, Cloudflare is exploring a template library of selectable Snippets that can be copied and modified with minimal coding knowledge.

Availability

Snippets is under development. The waitlist is open now, with a closed beta expected to begin in early 2023, followed by an open beta.