Configure HTTP header processing

Published April 5, 2023 | Last modified November 4, 2026

Overview

Configure HTTP header processing on an HTTP load balancer. You can add or remove request and response headers, cap header size, and customize error responses.

Important: These header processing options apply only to HTTP load balancers, not CDN load balancers. The CDN load balancer runs on different software and doesn't support them.

Predefined header variables

F5 Distributed Cloud provide predefined header variables. For example, you can set a response header with the name x-volterra-added and the value $[geoip_city].

Header variable	Description
`$[req_header_xxx]`	Returns the request header with name. Header name (`xxx`) is in lowercase and hyphen (`-`) is replaced with underscore (`_`).
`$[resp_header_xxx]`	Returns the response header with name. Header name (`xxx`) is in lowercase and hyphen (`-`) is replaced with underscore (`_`).
`$[query_params]`	Returns all query parameters in the request.
`$[query_param_xxx]`	Returns query parameter with name. Query parameter name (`xxx`) is in lowercase and hyphen (`-`) is replaced with underscore (`_`).
`$[url]`	Returns the URL.
`$[path]`	Returns the path.
`$[sni]`	Returns the server name identifier (SNI). Empty if SNI is absent.
`$[scheme]`	Returns HTTPS or HTTP based on the request.
`$[protocol]`	Returns HTTP protocol.
`$[client_address]`	Returns the client address.
`$[original_client_address]`	First entry in XFF header is treated as original client address.
`$[server_address]`	Address of the upstream server that handled the request.
`$[status]`	Response code.
`$[src_site]`	Name of the VER site that received the request.
`$[dest_site]`	Name of the VER site handling the request.
`$[tenant]`	Tenant of the request.
`$[namespace]`	Returns the namespace of the request.
`$[app_type]`	Returns the app type for the request.
`$[user]`	Returns the user of the request.
`$[geoip_country]`	GeoIP lookup output. Returns the country from where the request arrived.
`$[geoip_asn]`	GeoIP lookup output. Returns the ASN of the requestor.
`$[geoip_region]`	GeoIP lookup output. Returns the region from where the request arrived.
`$[geoip_city]`	GeoIP lookup output. Returns the city from where the request arrived.
`$[cookie_xxx]`	Returns the value of the cookie of the given name. Cookie name (`xxx`) is in lowercase and hyphen (`-`) is replaced with underscore (`_`).
`$[tls_fingerprint]`	Returns the TLS fingerprint of the request.
`$[req_start_time]`	Indicates the request start time. You can customize it using format strings. For example, `$[req_start_time(%Y/%m/%dT%H:%M:%S%z)]`. You can also use additional specifiers, like `%s`, `%f`, and `%[1-9]f`, where `%s` is the number of seconds since the Epoch and `%f/$[1-9]f` is a fractional number indicating nanoseconds. For example, the variable `$[req_start_time(%s.%3f)]` returns a value of `1527590590.528`.
`$[client_port]`	Provides the value of a client's (downstream) port.
`$[client_ssl_cipher]`	Returns the cipher used by the client.
`$[client_ssl_serial]`	Returns the client certificate serial number.
`$[client_ssl_issuer]`	Returns the client certificate issuer.
`$[client_ssl_subject]`	Returns the client certificate subject (same as DN).
`$[client_tls_version]`	Returns the client TLS version.
`$[client_ssl_cert_validity_start]`	Returns the client certificate validity start timestamp.
`$[client_ssl_cert_validity_end]`	Returns the client certificate validity end timestamp.
`$[client_tls_cert_uri_encoded]`	Returns the client TLS certificate with encoded URI.

Headers added by default

The F5 Distributed Cloud load balancer adds a set of HTTP headers by default.

HTTP header	Description
`X-Forwarded-For`	If the downstream request already includes this header, the load balancer prepends the client IP to the existing value.
`X-Forwarded-Proto`	Holds the protocol used (HTTP or HTTPS).
`X-Envoy-External-Address`	Holds the downstream client IP address.
`X-Envoy-Original-Authority`	Holds the actual domain name used by the downstream client.
`X-Request-Id`	Contains a UUID that identifies the HTTP request. If the downstream request also had `X-Request-Id`, then the header is unmodified.
`X-Envoy-Expected-Rq-Timeout-Ms`	Provides the upstream timeout configured for the matching route on the load balancer.

The load balancer preserves all HTTP headers, except the reserved headers listed above. It replaces those headers as shown, and it never updates X-Request-Id.

If the request contains one of these headers, the load balancer replaces it:

X-Forwarded-Proto
X-Envoy-External-Address
X-Envoy-Original-Authority
X-Envoy-Expected-Rq-Timeout-Ms

Before you begin

Before you begin, make sure you have:

An F5 Distributed Cloud account. If you don't have an account, see Get Started with Distributed Cloud Console.
A load balancer set up as a proxy for a service. To set one up, see Create HTTP Load Balancer.

Configure headers

Step 1: Go to load balancer.

Log in to Console.
Select Multi-Cloud App Connect.
Switch to your application namespace.
Select Manage > Load Balancers > HTTP Load Balancers.
Find your load balancer and select ... > Manage Configuration.
Select Edit Configuration.

Step 2: Configure advanced fields.

Go to the Other Settings section.
Optionally, select the Add Location checkbox. This adds the x-volterra-location header in the response messages. The value is the name of the Regional Edge (RE) Site. On Customer Edge (CE) sites, the load balancer ignores this option.
Select Configure under the More Options field.

Step 3: Add request headers.

In the Header Options section under the Add Request Headers field, select Add.
Enter the header name.
Select a choice from the Value or Secret list, and then enter the value name or configure the secret value.
Optionally, select the Append checkbox to append to existing values.
Select Apply.
Use Add to add multiple headers.

Note: The Distributed Cloud proxy adds the x-forwarded-for header by default for all requests. You can set the value of this header into another. Add a request header to the header name of your choice with value as $[req_header_x-forwarded-for].

Step 4: Remove request headers.

Under the Remove Request Headers field, select Add.
Enter the header key. This preserves the requester's original IP address by removing the header.
Use Apply to remove more headers.

Note: The Distributed Cloud proxy adds x-forwarded-for header by default for all requests.

Step 5: Add response headers.

Under the Add Response Headers field, select Add.
Enter the header name.
Select a value from the Value or Secret menu, and then enter the value name.
Optionally, select the Append checkbox to append to existing values.
Select Apply.

Note: You can set the HTTP Strict Transport Security (HSTS) by adding the Strict-Transport-Security response header and a value. A sample value is max-age=31536000.

Use Add to add more response headers.

Step 6: Remove response headers.

Under the Remove Response Headers field, select Add.
Enter the response header to remove.
Use Add to remove multiple response headers.

Step 7: Set a maximum size for the request header.

In the Maximum Request Header Size box, enter a value up to 96 KiB. The default is 60 KiB.

Step 8: Configure error response options.

In the Configure Error Response Options section, under the Custom Error Responses field, select Configure.
Select Add.
Enter a numerical value. The value must be 3, 4, 5, or in the 300 through 599 range.
Under the Error Response Body field, select Configure.
Select a string encoding type from the options available.
Enter a response in the box.
Select Apply.
Select Apply.

Step 9: Configure miscellaneous options.

In the Miscellaneous Options section under the Buffer Policy field, select Configure.
Enter a numeric value for the maximum request size for the buffer.
Optionally, select the Disable checkbox to disable a particular route.
Select Apply.
Under the Compression Parameters field, select Configure.
Complete the configuration parameters, and then select Apply.

Step 10: Apply and save the configuration.

Select Apply to apply the header options to the load balancer configuration.
Select Save HTTP Load Balancer to save the load balancer configuration.

References

For more information, see:

API references