You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The first command will return a three-letter IATA code in the [CF-Ray](/fundamentals/reference/http-request-headers/#cf-ray) header, indicating the Cloudflare data center location of processing and/or TLS termination. The second command will directly return the three-letter IATA code.
26
+
The first command will return a three-letter IATA code in the [Cf-Ray](/fundamentals/reference/http-headers/#cf-ray) header, indicating the Cloudflare data center location of processing and/or TLS termination. The second command will directly return the three-letter IATA code.
28
27
29
28
For example, when a hostname is configured to use the region European Union (EU), the three-letter IATA code will always return a data center inside of the EU.
Cloudflare passes all HTTP request headers to your origin web server and adds additional headers as specified below.
9
11
10
12
:::note
11
-
12
13
Cloudflare may remove HTTP request headers with names considered invalid [according to NGINX](https://nginx.org/en/docs/http/ngx_http_core_module.html#ignore_invalid_headers) — for example, header names containing a `.` (dot) character.
13
14
:::
14
15
15
-
## Accept-Encoding
16
+
###Accept-Encoding
16
17
17
18
For incoming requests, the value of this header will always be set to `accept-encoding: br, gzip`. If the client set a different value, such as `accept-encoding: deflate`, it will be overwritten and the original value will be available in `request.cf.clientAcceptEncoding`.
18
19
19
-
## CF-Connecting-IP
20
+
###CF-Connecting-IP
20
21
21
22
`CF-Connecting-IP` provides the client IP address connecting to Cloudflare to the origin web server.
22
23
This header will only be sent on the traffic from Cloudflare's edge to your origin web server.
23
24
24
-
For guidance on logging your visitor’s original IP address, refer to [Restoring original visitor IPs](/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/).
25
+
For guidance on logging your visitor's original IP address, refer to [Restoring original visitor IPs](/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/).
25
26
26
27
Alternatively, if you do not wish to receive the `CF-Connecting-IP` header or any HTTP header that may contain the visitor's IP address, [enable the **Remove visitor IP headers** Managed Transform](/rules/transform/managed-transforms/configure/).
27
28
28
-
### CF-Connecting-IP in Worker subrequests
29
+
####CF-Connecting-IP in Worker subrequests
29
30
30
-
In same-zone Worker subrequests, the value of `CF-Connecting-IP` reflects the value of `x-real-ip` (the client’s IP). `x-real-ip` can be altered by the user in their Worker script.
31
+
In same-zone Worker subrequests, the value of `CF-Connecting-IP` reflects the value of `x-real-ip` (the client's IP). `x-real-ip` can be altered by the user in their Worker script.
31
32
32
33
In cross-zone subrequests from one Cloudflare zone to another Cloudflare zone, the `CF-Connecting-IP` value will be set to the Worker client IP address `'2a06:98c0:3600::103'` for security reasons.
33
34
34
35
For Worker subrequests destined for a non-Cloudflare customer zone, the `CF-Connecting-IP` and `x-real-ip` headers will both reflect the client's IP address, with only the `x-real-ip` header able to be altered.
35
36
36
37
When no Worker subrequest is triggered, `cf-connecting-ip` reflects the client's IP address and the `x-real-ip` header is stripped.
37
38
38
-
## CF-Connecting-IPv6
39
+
###CF-Connecting-IPv6
39
40
40
41
Cloudflare provides [free IPv6 support](/network/ipv6-compatibility/) to all domains without requiring additional configuration or hardware. To support migrating to IPv6, Cloudflare's [Pseudo IPv4](/network/pseudo-ipv4/) provides an IPv6 to IPv4 translation service for all Cloudflare domains.
41
42
42
43
<Renderfile="pseudo-ipv4-warning" /> <br />
43
44
44
-
## CF-EW-Via
45
+
###CF-EW-Via
45
46
46
47
This header is used for loop detection, similar to the `CDN-Loop`[header](https://blog.cloudflare.com/preventing-request-loops-using-cdn-loop/).
47
48
48
-
## CF-Pseudo-IPv4
49
+
###CF-Pseudo-IPv4
49
50
50
51
If [Pseudo IPv4](/network/pseudo-ipv4/) is set to `Add Header` - Cloudflare automatically adds the `CF-Pseudo-IPv4` header with a Class E IPv4 address hashed from the original IPv6 address.
51
52
52
-
## True-Client-IP (Enterprise plan only)
53
+
###True-Client-IP (Enterprise plan only)
53
54
54
55
`True-Client-IP` provides the original client IP address to the origin web server. `True-Client-IP` is only available on an Enterprise plan. In the example below, `203.0.113.1` is the original visitor IP address. For example: `True-Client-IP: 203.0.113.1`
55
56
@@ -60,12 +61,10 @@ To add a `True-Client-IP` HTTP header to requests, [enable the **Add "True-Clien
60
61
Alternatively, if you do not wish to receive the `True-Client-IP` header or any HTTP header that may contain the visitor's IP address, [enable the **Remove visitor IP headers** Managed Transform](/rules/transform/managed-transforms/configure/).
61
62
62
63
:::caution
63
-
64
64
If you are using Cloudflare in a stacked CDN and authenticating HTTP requests based on the IP address value in the `True-Client-IP` header, you must add a `True-Client-IP` header to your requests. If you do not add this header, its value can be spoofed to any value.
65
-
66
65
:::
67
66
68
-
## X-Forwarded-For
67
+
###X-Forwarded-For
69
68
70
69
`X-Forwarded-For` maintains proxy server and original visitor IP addresses. If there was no existing `X-Forwarded-For`header in the request sent to Cloudflare, `X-Forwarded-For` has an identical value to the `CF-Connecting-IP` header.
71
70
@@ -76,28 +75,26 @@ If, on the other hand, an `X-Forwarded-For` header was already present in the re
76
75
If you do not wish to receive the visitor's IP address in the `X-Forwarded-For` header, or any HTTP header that may contain the visitor's IP address, [enable the **Remove visitor IP headers** Managed Transform](/rules/transform/managed-transforms/configure/).
77
76
78
77
:::note
79
-
80
78
To restore the original visitor IP address at your origin web server, Cloudflare recommends that your logs or applications look at `CF-Connecting-IP` or `True-Client-IP` instead of `X-Forwarded-For`. `CF-Connecting-IP` and `True-Client-IP` both have a consistent format containing only one IP address.
81
-
82
79
:::
83
80
84
-
## X-Forwarded-Proto
81
+
###X-Forwarded-Proto
85
82
86
83
`X-Forwarded-Proto` is used to identify the protocol (HTTP or HTTPS) that Cloudflare uses to connect to origin web server. By default, it is `http`. Certain [encryption mode](/ssl/origin-configuration/ssl-modes/) may change this header to `https` if the connection is encrypted.
87
84
88
85
For incoming requests, the value of this header will be set to the protocol the client used (`http` or `https`). If the client set a different value, it will be overwritten.
89
86
90
-
##CF-RAY
87
+
### Cf-Ray
91
88
92
-
The `CF-ray` header (otherwise known as a [Ray ID](/fundamentals/reference/cloudflare-ray-id/)) is a hashed value that encodes information about the data center and the visitor’s request. For example: `CF-RAY: 230b030023ae2822-SJC`.
89
+
The `Cf-Ray` header (otherwise known as a [Ray ID](/fundamentals/reference/cloudflare-ray-id/)) is a hashed value that encodes information about the data center and the visitor's request. For example: `Cf-Ray: 230b030023ae2822-SJC`.
93
90
94
-
Add the [`CF-Ray` header to your origin web server logs](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/#add-the-cf-ray-header-to-your-logs) to match requests proxied to Cloudflare to requests in your server logs.
91
+
Add the [`Cf-Ray` header to your origin web server logs](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/#add-the-cf-ray-header-to-your-logs) to match requests proxied to Cloudflare to requests in your server logs.
95
92
96
93
Enterprise customers can also see all requests via [Cloudflare Logs](/logs/).
97
94
98
-
## CF-IPCountry
95
+
###CF-IPCountry
99
96
100
-
The `CF-IPCountry` header contains a two-character country code of the originating visitor’s country.
97
+
The `CF-IPCountry` header contains a two-character country code of the originating visitor's country.
101
98
102
99
Besides the [ISO-3166-1 alpha-2 codes](https://www.iso.org/iso-3166-country-codes.html), Cloudflare uses the following special country codes:
103
100
@@ -107,44 +104,67 @@ Besides the [ISO-3166-1 alpha-2 codes](https://www.iso.org/iso-3166-country-code
107
104
To add this header to requests, along with other HTTP headers with location information for the visitor's IP address, [enable the **Add visitor location headers** Managed Transform](/rules/transform/managed-transforms/configure/).
108
105
109
106
:::note
110
-
111
107
The `CF-IPCountry` header is removed from requests made from a Worker to an origin that is not proxied behind Cloudflare.
112
-
113
108
:::
114
109
115
-
## CF-Visitor
110
+
###CF-Visitor
116
111
117
-
Currently, this header is a JSON object, containing only one key called “scheme”. The header will be either HTTP or HTTPS, and it is only relevant if you need to enable Flexible SSL in your Cloudflare settings. For example: `CF-Visitor: { \"scheme\":\"https\"}`.
112
+
Currently, this header is a JSON object, containing only one key called `scheme`. The header will be either HTTP or HTTPS, and it is only relevant if you need to enable Flexible SSL in your Cloudflare settings. For example: `CF-Visitor: { \"scheme\":\"https\"}`.
118
113
119
-
## CDN-Loop
114
+
###CDN-Loop
120
115
121
-
`CDN-Loop` allows Cloudflare to specify how many times a request can enter Cloudflare's network before it is blocked as a looping request. For example: `CDN-Loop: cloudflare`
116
+
`CDN-Loop` allows Cloudflare to specify how many times a request can enter Cloudflare's network before it is blocked as a looping request. For example: `CDN-Loop: cloudflare`.
122
117
123
-
## CF-Worker
118
+
###CF-Worker
124
119
125
-
The `CF-Worker` request header is added to an edge Worker subrequest that identifies the host that spawned the subrequest. This is useful when you want to protect yourself against cross-zone worker subrequests. For example: `CF-Worker: example.com`.
120
+
The `CF-Worker` request header is added to an edge Worker subrequest that identifies the host that spawned the subrequest. This is useful when you want to protect yourself against cross-zone Worker subrequests. For example: `CF-Worker: example.com`.
126
121
127
122
You can add `CF-Worker` header on server logs similar to the way you add the [`CF-RAY`](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/#add-the-cf-ray-header-to-your-logs) header. To do that, add `$http_cf_worker` in the log format file: `log_format cf_custom "CF-Worker:$http_cf_worker"'`
128
123
129
124
`CF-Worker` is added to all Worker subrequests sent via `fetch()`. It is set to the name of the zone which owns the Worker making the subrequest. For example, a Worker script on route for `foo.example.com/*` from `example.com` will have all subrequests with the header:
130
125
131
-
`CF-Worker`: `example.com`
126
+
```txt
127
+
CF-Worker: example.com
128
+
```
132
129
133
130
The intended purpose of this header is to provide a means for recipients (for example, origins, load balancers, other Workers) to recognize, filter, and route traffic generated by Workers on specific zones.
134
131
135
132
:::note
136
-
137
-
When configuring WAF custom rules, do not match on this header. These rules are applied before Cloudflare adds the `CF-Worker` header. Instead, use the [`cf.worker.upstream_zone`](/ruleset-engine/rules-language/fields/reference/cf.worker.upstream_zone/) dynamic field, which contains the same value and exists for the same purpose.
138
-
133
+
When configuring WAF custom rules, do not match on this header. These rules are applied before Cloudflare adds the `CF-Worker` header. Instead, use the [`cf.worker.upstream_zone`](/ruleset-engine/rules-language/fields/reference/cf.worker.upstream_zone/) field, which contains the same value and exists for the same purpose.
139
134
:::
140
135
141
-
## Connection
136
+
###Connection
142
137
143
138
For incoming requests, the value of this header will always be set to `Keep-Alive`. If the client set a different value, such as `close`, it will be overwritten. Note that is also the case when the client uses HTTP/2 or HTTP/3 to connect.
144
139
145
-
## Considerations for Spectrum
140
+
###Considerations for Spectrum
146
141
147
142
When using Spectrum with a TCP application, these headers are not visible at the origin as they are HTTP headers. If you wish to utilize these in your application, there are two options:
148
143
149
144
- Use an HTTP or HTTPS Spectrum app instead of TCP
150
145
- Use the [Proxy Protocol feature](/spectrum/how-to/enable-proxy-protocol/)
146
+
147
+
## Response headers
148
+
149
+
Cloudflare will remove some HTTP headers from the response sent back to the visitor and add some Cloudflare-specific HTTP headers.
150
+
151
+
### Removed response headers
152
+
153
+
Cloudflare passes all HTTP headers in the response from the origin server back to the visitor with the exception of the following headers:
154
+
155
+
-`X-Accel-Buffering`
156
+
-`X-Accel-Charset`
157
+
-`X-Accel-Limit-Rate`
158
+
-`X-Accel-Redirect`
159
+
160
+
### Added response headers
161
+
162
+
Cloudflare adds the HTTP headers specified below to the response sent to the visitor.
163
+
164
+
#### Cf-Ray
165
+
166
+
The `Cf-Ray` value returned to the visitor will be the same `Cf-Ray` value that was sent to the origin server.
167
+
168
+
#### Cf-Cache-Status
169
+
170
+
A list of all possible `Cf-Cache-Status` values is contained in [Cloudflare cache responses](/cache/concepts/cache-responses/).
IP geolocation adds the [`CF-IPCountry` header](/fundamentals/reference/http-request-headers/#cf-ipcountry) to all requests to your origin server.
9
+
IP geolocation adds the [`CF-IPCountry` header](/fundamentals/reference/http-headers/#cf-ipcountry) to all requests to your origin server.
10
10
11
11
Cloudflare automatically updates its IP geolocation database using MaxMind and other data sources, typically twice a week.
12
12
@@ -36,7 +36,7 @@ To enable **IP Geolocation** with the API, send a [`PATCH`](/api/resources/zones
36
36
37
37
:::note
38
38
39
-
In order to use this data, you will need to then retrieve it from the [`CF-IPCountry` header](/fundamentals/reference/http-request-headers/#cf-ipcountry).
39
+
In order to use this data, you will need to then retrieve it from the [`CF-IPCountry` header](/fundamentals/reference/http-headers/#cf-ipcountry).
Enabling the True-Client-IP Header adds the [`True-Client-IP` header](/fundamentals/reference/http-request-headers/#true-client-ip-enterprise-plan-only) to all requests to your origin server, which includes the end user’s IP address.
9
+
Enabling the True-Client-IP Header adds the [`True-Client-IP` header](/fundamentals/reference/http-headers/#true-client-ip-enterprise-plan-only) to all requests to your origin server, which includes the end user's IP address.
11
10
12
11
## Availability
13
12
@@ -18,17 +17,13 @@ Enabling the True-Client-IP Header adds the [`True-Client-IP` header](/fundament
18
17
The recommended procedure to access client IP information is to [enable the **Add "True-Client-IP" header** Managed Transform](/rules/transform/managed-transforms/reference/#add-true-client-ip-header).
19
18
20
19
:::note
21
-
22
-
23
-
In order to use this data, you will need to then retrieve it from the [`True-Client-IP` header](/fundamentals/reference/http-request-headers/#cf-ipcountry).
24
-
25
-
20
+
To use this data, you will need to then retrieve it from the [`True-Client-IP` header](/fundamentals/reference/http-headers/#cf-ipcountry).
26
21
:::
27
22
28
23
## Additional resources
29
24
30
25
For additional guidance on using True-Client-IP Header with Cloudflare, refer to the following resources:
0 commit comments