Headers
Every response from the edge carries a few headers of ours, the most useful being X-CDN-Cache, and every request to your origin carries a few that say who really asked. A cached response also keeps a fixed set of your origin's own headers.
Headers on every response#
| Header | Value |
|---|---|
| X-CDN-Cache | HIT, MISS or BYPASS: see below |
| X-CDN-Location | The id of the location that answered: the same ids the API's location list uses |
| X-CDN-Name | CacheGenie CDN |
| Server | CacheGenie CDN, replacing whatever your origin sent, on a response that carries your content; the edge's own pages do not carry it |
| Accept-Ranges | bytes, on a response that carries your content |
| X-Content-Type-Options | nosniff |
| Age | On a hit, the seconds since the copy was stored or last refreshed; 0 on the request that stored it |
Header names are case-insensitive; over HTTP/2 a client sees them in lower case.
X-CDN-Cache#
- HIT: served from the edge's copy. A copy that has expired and is being refreshed in the background reads HIT as well, since the viewer was served from it.
- MISS: fetched from your origin on this request: the first request for a file, a piece of a large file the edge did not have, or a response that could not be stored, such as an error, a redirect or a response marked
no-store. The edge's own pages, an error page or a refusal, read MISS as well. - BYPASS: passed straight through because of the request itself: a method other than GET and HEAD, an
Authorizationheader, a cookie on a zone that does not strip them, a request that asks for an event stream, or a WebSocket. The maintenance page reads BYPASS too.
Headers added by a setting#
| Header | When |
|---|---|
| Strict-Transport-Security: max-age=31536000 | Force SSL is on for the hostname, on a response that carries your content |
| Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Access-Control-Max-Age: 86400 | Add CORS Headers is on, for .css, .eot, .ttf, .woff and .woff2 files |
| Link: <origin url + path>; rel="canonical" | Add Canonical Headers is on, on a standard origin, replacing any Link your origin sent |
| X-CDN-Token | A signed link was refused: the reason. See Token authentication |
| X-CDN-Block | A visitor was refused by a blocking rule: the rule. See Blocking visitors |
| X-CDN-Limit | A request was refused because one address asked too much at once (rate, in-flight, live or origin), or because the zone's requests already held half of those that location had waiting on origins and this one waited 30 seconds for a place (zone). See Error pages and status codes |
| X-CDN-Loop | reported, on the 502 page when your origin leads back to us, directly or through a proxy of yours: we have found the loop and logged it |
| Retry-After | On the maintenance page (300 seconds), when a request could not be served just now (30), and on a 429 (the seconds until that address may ask again) |
What a cached response keeps of your origin's headers#
A hit replays only these, the first value of each:
Content-Type, Content-Encoding, Content-Language, Content-Disposition, Cache-Control, Expires, ETag, Last-Modified, Vary, every Access-Control-* header, Timing-Allow-Origin, Cross-Origin-Resource-Policy, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Link, X-Robots-Tag.
The response to the request that fetched a file of 10 MB or less relays everything else your origin sent as well, apart from connection headers, Alt-Svc, Age, Server and the X-CDN-Name, X-CDN-Location and X-CDN-Cache names, which are ours. A larger file is answered from the stored set on every request, the first included. So a custom header from your origin is seen once on a small file and never on a large one. Link is replaced by the canonical one while Add Canonical Headers is on, and Set-Cookie is removed from every response when Strip Response Cookies is on.
What your origin receives#
| Header | Value |
|---|---|
| Via | 1.1 CacheGenie-CDN (z={ZONE_ID}; t={time}; s={signature}), on every request: the same signed marker as CDN-Loop, in the comment of our entry |
| CDN-Loop | CacheGenie-CDN; z={ZONE_ID}; t={time}; s={signature}, our entry signed for the zone, after any other CDN's entries the request came with (RFC 8586), on every request. A request that comes back to us carrying it is a loop and is answered with the 502 page |
| User-Agent | The viewer's, on the request that fetches a file or passes through. CacheGenie-CDN/ and our engine's version when the edge fetches for itself: a further piece of a large file, or the refresh of an expired copy; and after them loop-probe/ and a token on a loop probe, the extra requests that also carry cdn-loop-probe= on the query and, on two of them, cdn-loop-probe. and the token in the path (see Full site origins) |
| X-Forwarded-For | The viewer's address, exactly one, on the request that fetches a file or passes through; anything the viewer sent in that header is removed rather than appended to |
| X-CDN-Connecting-IP | The same address, in a header no client can prefill: the edge writes it from the connection it accepted, and refuses a request that arrives already carrying one as a loop |
| X-Forwarded-Proto | http or https, as the viewer connected, on the request that fetches a file or passes through; not on the edge's own fetches |
| X-Forwarded-Host | The hostname the viewer used |
| Host | The hostname from the Origin URL, or the Host Header field when set; the viewer's hostname when Forward Host Header is on; always the bucket's own for a bucket origin |
| Range | On the first fetch of a file (its first 10 MB) and on each piece of a large file; a viewer's own range on a pass-through; none on the refresh of a file stored whole |
| If-Range, If-None-Match, If-Modified-Since | On the edge's own fetches: If-Range with each piece of a large file (a strong ETag, or else the Last-Modified date), the other two on the refresh of an expired copy |
| Accept-Encoding | On a cache fill, the bucket the viewer's request was sorted into: br, gzip, br, gzip or identity; on a pass-through, the viewer's own value |
Every fetch is a GET, a HEAD from a viewer included. On a standard or bucket origin, a cache fill forwards only Accept, Accept-Language and User-Agent from the viewer's request, and a bypass forwards those plus Accept-Encoding, Range, the conditional headers (If-None-Match, If-Modified-Since, If-Range), Authorization, Cookie where it is not stripped, Content-Type, Origin, the CORS preflight headers and Last-Event-ID, and a WebSocket handshake its own Sec-WebSocket-* headers besides; Referer is never forwarded, and Authorization never reaches a bucket. A full site forwards everything the visitor sent apart from the connection's own headers and the forwarded set below, and its cache fills also leave out Cookie, Authorization and the conditional headers: see Full site origins.
X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host, X-Real-IP and Forwarded from a client never reach your origin: the first three are written fresh by us and the other two dropped. On a standard or bucket origin nothing else of the client's does either; on a full site any other header is forwarded as sent, X-Forwarded-Port and its relatives included.