Skip to main content

​
Request headers

Upsun adds the following HTTP headers to give the application information about the connection. These are stable and may be examined by the application as necessary.
  • X-Forwarded-Proto: The protocol forwarded to the application, for example: http, https.
  • X-Client-IP: The remote IP address of the request.
  • X-Client-SSL: Set “on” only if the client is using SSL connection, otherwise the header isn’t added.
  • X-Original-Route: The route in .upsun/config.yaml which is used currently, for example: https://{default}/.
  • X-Forwarded-For: The client IP appended to any value sent by the client. When the request comes through a CDN that Upsun supports, the header is replaced with the end-client IP instead.

​
Headers overwritten or removed from requests

Upsun passes your application’s request headers through, with the exceptions below. These headers are set from values Upsun determines itself, so a client can’t spoof them and your application can trust them. Repeated headers are also normalized into a single value. Most are joined with a comma and a space, Cookie is joined with a semicolon and a space, and headers that aren’t lists, such as Content-Type or Authorization, keep only their first value.

​
Response headers

Upsun adds a number of response headers automatically to assist in debugging connections. These headers should be treated as a semi-private API. Do not code against them, but they may be inspected to help determine how Upsun handled the request to aid in debugging.
  • X-Platform-Cache: Either HIT or MISS to indicate if the router in your cluster served the response from its own cache or if the request was passed through to the application.
  • X-Platform-Cluster: The ID of the cluster that received the request. The cluster name is formed from the project ID and environment ID.
  • X-Platform-Processor: The ID of the container that generated the response. The container ID is the cluster ID plus the container name.
  • X-Platform-Router: The ID of the router that served the request. The router ID is the processor ID of the router container, specifically.
  • X-Debug-Info: This is a header added by the edge layer. It doesn’t contain any sensitive information or anything that could be misused. It has no relation to the PHP debugging tool Xdebug.

​
Headers overwritten or removed from responses

Your application’s response headers reach the client unchanged, apart from the following. Repeated response headers are normalized the same way as request headers, so send a single Content-Type or Location rather than several. Set-Cookie is the exception and keeps every value you send. Upsun also ignores Expires when deciding whether to cache a response. The header still reaches the client, but use Cache-Control to control caching.

​
Classification data headers

Upsun sends classification data to your backend system through the following HTTP headers. Each of them is set from Upsun’s own data, or removed when there’s no data for the request, so you can rely on their values even if a client sends its own.

​
Custom headers

Apart from those listed above, your application is responsible for setting its own response headers. You can also add headers to static files.
Last modified on July 30, 2026