HTTP Headers

HTTP Headers

HTTP headers are a core part of HTTP requests and responses. They carry additional information about the client, requested host, original protocol, proxy route, and other connection details.

When an application is accessed through the platform load-balancing infrastructure, the application server receives additional headers that can be used to identify the original client request and the proxy path.

On this page

HTTP Header Overview

An HTTP request can pass through one or more load balancers or proxy servers before it reaches the application container. Each intermediary may add headers that describe the original client and connection.

The application can inspect these values for logging, redirects, access control, analytics, and generation of absolute URLs.

Forwarded Request Headers

Header Description Example
x-forwarded-for A comma-separated chain of IP addresses that identifies the originating client and the proxies through which the request passed. The first address is generally the original client. 203.0.113.10, 10.20.30.40
x-real-ip The ending IP address in the x-forwarded-for chain, representing the most recent proxy or client address visible to the web server. 10.20.30.40
x-forwarded-proto The protocol used by the original client request before it reached the proxy, normally http or https. https
x-forwarded-port The public port used by the client for the original request. 443
x-forwarded-host The original host requested by the client before proxy processing. example.com
x-host The host value passed through the platform load-balancing infrastructure. example.com
Header names are case-insensitive. Depending on the application framework or server, they may appear with different capitalisation or as server variables such as HTTP_X_FORWARDED_FOR.

Connection Scheme

A typical request path contains three stages:

  • The client sends an HTTP or HTTPS request to the application domain.
  • The shared or dedicated load balancer receives the request and adds forwarding headers.
  • The application container receives the proxied request and reads the forwarded values.
Client Browser
      |
      | HTTPS request to example.com
      v
Platform Load Balancer
      |
      | Adds x-forwarded-* and related headers
      v
Application Container

Request Example

A request received by an application behind a platform load balancer may contain headers similar to the following:

Host: example.com
X-Forwarded-For: 203.0.113.10, 10.20.30.40
X-Real-IP: 10.20.30.40
X-Forwarded-Proto: https
X-Forwarded-Port: 443
X-Forwarded-Host: example.com
X-Host: example.com

An application can use x-forwarded-proto to determine whether the original request was secure and use x-forwarded-for to identify the client address.

Redirect handling: When HTTPS is terminated at the load balancer, the internal connection to the application may use HTTP. Configure the application or framework to trust the platform proxy and read x-forwarded-proto before generating redirects.

Security Considerations

  • Forwarded headers can be forged when requests are allowed to reach the application directly.
  • Trust these values only when the request is known to come through the platform load balancer or another trusted proxy.
  • Configure the application framework’s trusted-proxy list correctly.
  • When parsing x-forwarded-for, consider the complete proxy chain rather than accepting an arbitrary address without validation.
  • Use the original protocol and host values carefully when generating redirects or absolute URLs.

What’s next?

  • Environment Variables
  • Shared Load Balancer
  • Public IP
  • Custom Domain Name
  • Built-In SSL