Previously (older Magento 2.2~ versions), exporting default.vcl Varnish Magento 2 configuration:

Configuration -> Advanced -> System -> Full Page Cache -> Varnish Configuration : Export VCL for Varnish 4.0

This gave me a comment inside default.vcl created:

# The minimal Varnish version is 4.0
# For SSL offloading, pass the following header in your proxy server or load balancer: 'X-Forwarded-Proto: https'

Now, with Magento v2.3.5 VCL files for 4,5,6 are :

# The minimal Varnish version is 4.0
# For SSL offloading, pass the following header in your proxy server or load balancer: 'SSL-OFFLOADED: https'

What is the difference between the two Headers, do I need to use both or update from X-Forwarded-Proto to SSL-OFFLOADED?


Because Varnish Cache doesn't have native TLS support, you'll need TLS termination software to handle the TLS part for you. This also means that Varnish only accepts plain HTTP.

However, your Magento server does rely on HTTPS, but Varnish only sends plain HTTP. To make Magento TLS-aware, a specific header can be sent, containing the protocol that was used by the client to connect.

Typically, the X-Forwarded-Proto header is used for that. It either contains http or https. Magento uses this value to use the proper URL scheme in the links it builds.

Apparently SSL-OFFLOADED is the one your Magento installation prefers.

My advice is to just set both. Just add the following code in your Nginx config, just before proxy_pass:

proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Ssl-Offloaded $scheme;

HTTP headers are case-insensitive, to the casing doesn't really matter.

  • Thanks :) I have a Nginx proxy, with Apache2 that handles Magento2 (PHP). Varnish should be used in Nginx I guess - proxy_pass site:6081. Is this correct? – CvRChameleon Sep 11 '20 at 9:04
  • Just added the Nginx config to my answer. – Thijs Feryn Sep 11 '20 at 10:23
  • Thank you, as the other question showed, turns out that SSL_OFFLOADED most likely came from my migrated Magento 1 data. I always assumed Magento 2.3 exports for new VCL files are default configurations (without relying of values defined in database - except for the Access List, Host, Port settings in backend). I will use both as you suggest. $scheme is the protocol correct? https/http for instance? – CvRChameleon Sep 11 '20 at 11:16
  • 1
    @CvRChameleon Absolutely, if you go to nginx.org/en/docs/http/ngx_http_core_module.html and look for $scheme, you'll see the values it can have. It's either http or https, based on the URL scheme that was received by Nginx for this request. – Thijs Feryn Sep 13 '20 at 18:47

It is actually the other way around.

At least based on app/code/Magento/Store/etc/config.xml, only at Magento 2.0 there was a preference towards SSL_OFFLOADED. This is more or less "legacy" header name back from Magento 1.x

The X-Forwarded-Proto is used, by default, from Magento 2.1 onwards (check here). It is a de-facto standard (but not official) header name for forwarding the original (often client's) protocol.

Note that which header Magento will use to find out if the connection was over TLS, is stored in the configuration.

If you exported configuration to app/etc/config.php it is stored in that file, e.g.:

'secure' => [
    'base_web_url' => '{{secure_base_url}}',
    'offloader_header' => 'SSL_OFFLOADED',

Otherwise, it is stored in core_config_data, under the key web/secure/offloader_header.

So if you are upgrading from version to version, the value is preserved. E.g. if you installed from Magento 2.0 and were upgrading all the way to Magento 2.3.x, Magento will still use SSL_OFFLOADED.

On a new install of Magento >= 2.1.x, the value would default to X-Forwarded-Proto.

Be noted, that depending on how you configure your stack, you may not need to bother with whether Magento 2 sees any header like this at all.

E.g. with NGINX, you can simply tell that the connection is being handled over HTTPS via fastcgi_param HTTPS $fastcgi_https if_not_empty; where the variable in question is made up by mapping out the actual header you configure:

map $http_x_forwarded_proto $fastcgi_https {
    default off;
    https on;

Then any PHP code would correctly identify the connection as encrypted and there would be no reliance on SSL offloading headers in PHP code itself.

  • Thanks Danila, I am now really confused to be honest. I just did new exports again on my v2.3.5 - and they show SSL_OFFLOADED. The reason why I originally exported new ones was because my new installation complains about my old v4.0 default.vcl file. Everywhere return (miss); used to be will fail when Varnish starts up - and the new export has return (restart); for v6 files. **ALL v4,5,6 newly exported entries use SSL-OFFLOADED if (req.http.SSL-OFFLOADED) { hash_data(req.http.SSL-OFFLOADED); }. I am confused because this is the opposite of what you say. – CvRChameleon Sep 11 '20 at 9:02
  • It is also stored in the database configuration. Updated my answer to reflect that. – Danila Vershinin Sep 11 '20 at 9:23
  • Thanks for the update, the explanation cleared up the confusion : I am migrating data from Magento 1, and never realized that the new exports built parameters based on configuration - from the database (in my case web/secure/offloader_header in core_config_data) or app/etc/config.php (didn't exist here). – CvRChameleon Sep 11 '20 at 11:09
  • How would I be able to create the map as your sample were for fastcgi_param when I use Nginx as proxy, Varnish cache, and Apache as web Server? – CvRChameleon Sep 11 '20 at 11:12
  • 1
    fastcgi_param applies only when you use NGINX as the web server. Since you already use it as proxy (for TLS I guess), I would ditch Apache completely. – Danila Vershinin Sep 11 '20 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.