Varnish Cache Magento 2 SSL offloading - X-Forwarded-Proto: https vs SSL-OFFLOADED: https

Question

Previously (older Magento 2.2~ versions), exporting default.vcl Varnish Magento 2 configuration:

Configuration -> Advanced -> System -> Full Page Cache -> Varnish Configuration : Export VCL for Varnish 4.0

This gave me a comment inside default.vcl created:

# The minimal Varnish version is 4.0
# For SSL offloading, pass the following header in your proxy server or load balancer: 'X-Forwarded-Proto: https'

Now, with Magento v2.3.5 VCL files for 4,5,6 are :

# The minimal Varnish version is 4.0
# For SSL offloading, pass the following header in your proxy server or load balancer: 'SSL-OFFLOADED: https'

What is the difference between the two Headers, do I need to use both or update from X-Forwarded-Proto to SSL-OFFLOADED?

Answer 1

Because Varnish Cache doesn't have native TLS support, you'll need TLS termination software to handle the TLS part for you. This also means that Varnish only accepts plain HTTP.

However, your Magento server does rely on HTTPS, but Varnish only sends plain HTTP. To make Magento TLS-aware, a specific header can be sent, containing the protocol that was used by the client to connect.

Typically, the X-Forwarded-Proto header is used for that. It either contains http or https. Magento uses this value to use the proper URL scheme in the links it builds.

Apparently SSL-OFFLOADED is the one your Magento installation prefers.

My advice is to just set both. Just add the following code in your Nginx config, just before proxy_pass:

proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Ssl-Offloaded $scheme;

HTTP headers are case-insensitive, to the casing doesn't really matter.

Answer 2

It is actually the other way around.

At least based on app/code/Magento/Store/etc/config.xml, only at Magento 2.0 there was a preference towards SSL_OFFLOADED. This is more or less "legacy" header name back from Magento 1.x

The X-Forwarded-Proto is used, by default, from Magento 2.1 onwards (check here). It is a de-facto standard (but not official) header name for forwarding the original (often client's) protocol.

Note that which header Magento will use to find out if the connection was over TLS, is stored in the configuration.

If you exported configuration to app/etc/config.php it is stored in that file, e.g.:

'secure' => [
    'base_web_url' => '{{secure_base_url}}',
    ...
    'offloader_header' => 'SSL_OFFLOADED',
    ...

Otherwise, it is stored in core_config_data, under the key web/secure/offloader_header.

So if you are upgrading from version to version, the value is preserved. E.g. if you installed from Magento 2.0 and were upgrading all the way to Magento 2.3.x, Magento will still use SSL_OFFLOADED.

On a new install of Magento >= 2.1.x, the value would default to X-Forwarded-Proto.

Be noted, that depending on how you configure your stack, you may not need to bother with whether Magento 2 sees any header like this at all.

E.g. with NGINX, you can simply tell that the connection is being handled over HTTPS via fastcgi_param HTTPS $fastcgi_https if_not_empty; where the variable in question is made up by mapping out the actual header you configure:

map $http_x_forwarded_proto $fastcgi_https {
    default off;
    https on;
}

Then any PHP code would correctly identify the connection as encrypted and there would be no reliance on SSL offloading headers in PHP code itself.