Magento 2: What is Offloader header?

Question

What is the use of Offloader header in CDN?

What is the difference between SSL_OFFLOADED and X-Forwarded-Proto.

When to use it? Is there any other type as well apart from the above two?

Answer 1

There is no difference. The default offloader header in Magento 2 is X-Forwarded-Proto, which matches the de facto standard.

SSL_OFFLOADED on the other hand, was the default offloader header in Magento 1, and also used by Nexcess_Turpentine, the popular Varnish extension for Magento 1.

Basically, you can call the header however you want, you just have to make sure that your SSL terminator sends it. If you are not sure, X-Forwarded-Proto is probably the right value.

Answer 2

Offloader header and HTTPS server variable are used by Magento 2 to figure out if request is secure (https).

if you don't set server variable HTTPS

fastcgi_param HTTPS on

then magento checks Offloader header:

vendor/magento/framework/App/Request/Http.php

public function isSecure()
{
    if ($this->immediateRequestSecure()) {
        return true;
    }
    /* TODO: Untangle Config dependence on Scope, so that this class can be instantiated even if app is not
    installed MAGETWO-31756 */
    // Check if a proxy sent a header indicating an initial secure request
    $config = $this->objectManager->get('Magento\Framework\App\Config');
    $offLoaderHeader = trim(
        (string)$config->getValue(
            self::XML_PATH_OFFLOADER_HEADER,
            ScopeConfigInterface::SCOPE_TYPE_DEFAULT
        )
    );

    return $this->initialRequestSecure($offLoaderHeader);
}

....

protected function initialRequestSecure($offLoaderHeader)
{
    $header = $this->getServer($offLoaderHeader);
    $httpHeader = $this->getServer('HTTP_' . $offLoaderHeader);
    return !empty($offLoaderHeader)
    && (isset($header) && ($header === 'https') || isset($httpHeader) && ($httpHeader === 'https'));
}

see initialRequestSecure function, if Offloader header (or HTTP_{Offloader header}) is set to https then request is secure.

Answer 3

Offloader headers are used to identify whether a CDN has handled a request. This is especially useful for debugging since it allows developers to determine whether a request is being served from a CDN or the origin server. Additionally, it helps CDN providers to track usage and performance metrics for their clients.

SSL_OFFLOADED is a request header that indicates that the incoming request has been encrypted by an SSL (Secure Socket Layer) protocol. This is generally used by reverse proxies, load balancers, and web servers to indicate that the request has been secured. X-Forwarded-Proto is also a request header used to indicate the protocol of the incoming request. However, this header is only used when an HTTP request is received by a proxy and then forwarded to the actual server. It indicates the protocol (HTTP or HTTPS) used to make the original request. Therefore, the main difference between SSL_OFFLOADED and X-Forwarded-Proto is that SSL_OFFLOADED indicates that the request was encrypted via an SSL protocol. In contrast, X-Forwarded-Proto is used to indicate the protocol of the original request.

SSL_OFFLOADED and X-Forwarded-Proto are headers that can be used to identify whether a request is being served over HTTPS or HTTP. Web servers typically use these headers behind load balancers or reverse proxies serving SSL traffic. Yes, other types of headers can be used to identify whether a request is being served over HTTPS or HTTP. These include X-Forwarded-Ssl, X-SSL-Cipher, and X-SSL-Protocol.