What is the use of Off loader header in CDN?

What is the difference between SSL_OFFLOADED & X-Forwarded-Proto.

When to use it? Is there any other type as well apart from above two?


There is no difference. The default offloader header in Magento 2 is X-Forwarded-Proto, which matches the de facto standard.

SSL_OFFLOADED on the other hand, was the default offloader header in Magento 1, and also used by Nexcess_Turpentine, the popular Varnish extension for Magento 1.

Basically, you can call the header however you want, you just have to make sure that your SSL terminator sends it. If you are not sure, X-Forwarded-Proto is probably the right value.

| improve this answer | |
  • as of Magento 2.0.5 default is SSL_OFFLOAD. check vendor/magento/module-store/etc/config.xml – Konstantin Gerasimov Dec 22 '16 at 10:40
  • 1
    @KonstantinGerasimov not in the current version. I checked the history in Github, they recently changed it: github.com/magento/magento2/commit/… (and later fixed it to be X-Forwarded-Proto instead of X_FORWARDED_PROTO) – Fabian Schmengler Dec 22 '16 at 10:44
  • you are right. it pays to upgrade my dev environment from time to time – Konstantin Gerasimov Dec 22 '16 at 10:54

Offloader header and HTTPS server variable are used by Magento 2 to figure out if request is secure (https).

if you don't set server variable HTTPS

fastcgi_param HTTPS on

then magento checks Offloader header:


public function isSecure()
    if ($this->immediateRequestSecure()) {
        return true;
    /* TODO: Untangle Config dependence on Scope, so that this class can be instantiated even if app is not
    installed MAGETWO-31756 */
    // Check if a proxy sent a header indicating an initial secure request
    $config = $this->objectManager->get('Magento\Framework\App\Config');
    $offLoaderHeader = trim(

    return $this->initialRequestSecure($offLoaderHeader);


protected function initialRequestSecure($offLoaderHeader)
    $header = $this->getServer($offLoaderHeader);
    $httpHeader = $this->getServer('HTTP_' . $offLoaderHeader);
    return !empty($offLoaderHeader)
    && (isset($header) && ($header === 'https') || isset($httpHeader) && ($httpHeader === 'https'));

see initialRequestSecure function, if Offloader header (or HTTP_{Offloader header}) is set to https then request is secure.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.