What is a full specification of X-Forwarded-Proto HTTP header?

by

There is no “full specification” — it’s a de facto standard. The X- in front of a header name customarily* has denoted it as experimental/non-standard/vendor-specific. Once it’s a standard part of HTTP, it’ll lose the prefix.

There’s some work from the IETF on standardizing it, but it’s just at the draft stages, as far as i can tell. Check out https://datatracker.ietf.org/doc/html/draft-ietf-appsawg-http-forwarded-10 for the latest draft as of the time of this writing. But be aware that it can change at any time while it’s being fleshed out, and don’t rely on it in production stuff yet.

Update:

RFC 7239 now defines the Forwarded: header, which is intended to replace X-Forwarded-*. If you care about standards, i would recommend using that instead.

* This used to be an official thing, but no longer is. RFC 6648 deprecates the X- prefixing convention. Unfortunately, the convention is so widely known (and the deprecation so low-key) that most people outside the IETF will probably ignore the recommendation.

More Related Contents:

  1. Are HTTP headers case-sensitive?
  2. Do I need Content-Type: application/octet-stream for file download?
  3. Custom HTTP headers : naming conventions
  4. Uses of content-disposition in an HTTP response header
  5. ‘Refresh’ HTTP header
  6. Difference between Pragma and Cache-Control headers?
  7. Is there a practical HTTP Header length limit?
  8. Detecting the character encoding of an HTTP POST request
  9. What are all the possible values for HTTP “Content-Type” header?
  10. Ideal HTTP cache control headers for different types of resources
  11. Remove http referer
  12. How can I get the clients IP address from HTTP headers?
  13. How to forward headers on HTTP redirect
  14. Difference between Content-Range and Range headers?
  15. What is q=0.5 in Accept* HTTP headers?
  16. How big can a user agent string get?
  17. How can I find out whether a server supports the Range header?
  18. Setting HTTP headers
  19. What HTTP response headers are required
  20. what characters are allowed in HTTP header values?
  21. Does the HTTP Protocol support multiple content types in response headers?
  22. What is the http-header “X-XSS-Protection”?
  23. How to evaluate http response codes from bash/shell script?
  24. What does HTTP/1.1 302 mean exactly?
  25. HTTP Cache Control max-age, must-revalidate
  26. Is the Content-Length header required for a HTTP/1.0 response?
  27. Is REST DELETE really idempotent?
  28. Avoid caching of the http responses
  29. Keep-alive header clarification
  30. S3: How to do a partial read / seek without downloading the complete file?

Leave a Comment