Search

HTTP fields change behind a proxy or CDN

Compare the same exchange at adjacent controlled hops before attributing a field change to the origin.

Difficulty
advanced
Published
July 13, 2026
Last reviewed
Review due
  • proxies
  • cdn
  • fields
  • diagnostics

Diagnostic overview

Symptoms

  • Client-visible fields differ from application logs for the apparent same request.
  • A field is present on one route or protocol version but absent on another.

Likely layers

proxy, cdn, origin, protocol

Common causes

  • A connection-specific field is correctly removed at a forwarding boundary.
  • CDN, reverse-proxy, compression, or security policy rewrites the message.
  • Logs compare different requests because correlation or cache status is missing.

Diagnostic steps

  1. Assign one safe correlation identifier and timestamp to a controlled request.

    Look for: Adjacent logs can now distinguish the same exchange from cache or retry traffic.

  2. Capture fields immediately before and after each controlled intermediary.

    Look for: The first differing pair identifies the responsible hop.

  3. Classify the field as connection-specific, end-to-end, or transformation-sensitive.

    Look for: Its specification determines whether removal or rewriting is correct.

Targeted fixes

  • Remove or rewrite connection-specific fields according to the receiving HTTP version.
  • Make explicit proxy transformations update dependent metadata and validators.
  • Restrict trusted forwarding fields to known proxy paths and document ownership.

Correlate the same exchange

Use a non-sensitive request identifier accepted by controlled infrastructure and compare timestamps, route, cache status, and protocol at adjacent hops.

X-Debug-Request: phase04-example-001

Expected result: controlled logs can correlate one diagnostic request. Do not expose internal identifiers publicly or accept a client value as trusted identity.

Classify the field

Connection-specific fields must not cross the hop. End-to-end fields are forwarded, but a permitted transformation can require updating representation metadata. Unknown field names are not automatically hop-by-hop.

Fix the first changing hop

Change the policy where the first observed difference occurs, then repeat the same bounded request. Bypassing the CDN or origin can confirm a boundary, but it changes the path and is not a substitute for hop correlation.

Primary sources