Request Headers
Overview
The Storefront Hosting platform forwards a defined set of HTTP request headers to your Storefront Application on every request. This page documents the five headers you can rely on - their values, their source, whether they are guaranteed or best-effort, and how to read them correctly.
Any HTTP header not listed here should be treated as outside the contract. Other headers may be present today, but they may change or be removed without notice. Do not build critical application logic on undocumented headers.
X-Forwarded-For
Guaranteed.
The client IP as seen by the platform edge. Contains the same value as CF-Connecting-IP.
We currently overwrite the X-Forwarded-For header and do not forward external IPs. This restriction prevents IP spoofing.
Example: 203.0.113.5
Use this to identify the visitor's IP.
In progress: SCAYLE is working on enabling support for proxied-origin setups (where an upstream proxy such as Akamai forwards traffic to SCAYLE). Until this ships, this header reflects the proxy's IP in such setups, not the true visitor IP.
X-Forwarded-Proto
Guaranteed.
The scheme used to reach the platform edge. Always https, since all platform traffic is encrypted.
Example: https
Use this for generating absolute URLs, canonicals, and redirects in your application.
X-Forwarded-Host
Guaranteed.
The host the request was originally addressed to. This is either a <unique>.sf.scayle.shop default host or a custom domain configured for the environment.
Example: example.com
Use this when your application needs to render or link to its own hostname.
CF-Connecting-IP
Guaranteed (with proxied-origin caveat).
The client IP as seen by the platform edge. Contains the same value as X-Forwarded-For
Example: 203.0.113.5
Use this to identify the visitor's IP.
In progress: SCAYLE is working on enabling support for proxied-origin setups (where an upstream proxy such as Akamai forwards traffic to SCAYLE). Until this ships, this header reflects the proxy's IP in such setups, not the true visitor IP. In the meantime, your upstream proxy must expose the true visitor IP through its own header.
CF-IPCountry
Best-effort.
The ISO 3166-1 alpha-2 country code for the visitor's location.
Example: DE
Use this for geographic routing, feature toggling, or localization based on the visitor's country.
