PingAuthorize

API security gateway HTTP 1.1 support

As a reverse proxy, the API security gateway modifies HTTP requests and responses in addition to the changes required by policy processing.

Forwarded HTTP request headers

HTTP requests often pass through several intermediaries before reaching their destination server. HTTP 1.1 defines two relevant types of headers:

End-to-end headers

Headers requiring transmission to all recipients on the chain, such as Content-Type.

Hop-by-hop headers

Headers that are only relevant to the next recipient on the chain, such as Connection and Keep-Alive.

The API security gateway never forwards hop-by-hop headers. It forwards all end-to-end headers, with the following exceptions:

  • Headers related to HTTP resource versioning and conditional requests, such as If-None-Match and If-Modified-Since.

  • Headers related to CORS, such as Origin or Access-Control-Request-Method.

  • Headers that you exclude by using the allowed-headers configuration property of an API External Server to define an allow list of forwarded headers.

  • Headers that you remove by using a custom statement extension.

The API security gateway always adds the following headers to forwarded requests:

  • Host

  • Accept-Encoding

  • Via

  • X-Forwarded-For

  • X-Forwarded-Host

  • X-Forwarded-Port

  • X-Forwarded-Proto

If the use-correlation-id-header property is enabled on the HTTP Connection Handler, the gateway also adds a correlation ID header to the forwarded request. Learn more in Configuring correlation IDs.

You can use the http-auth-evaluation-behavior property of a Gateway API Endpoint to alter the Authorization header of a forwarded request.

Forwarded HTTP response headers

The API security gateway forwards most HTTP response headers, with the following exceptions:

  • The Date header is replaced with a value generated by the API security gateway.

  • The Content-Length header is replaced with a value generated by the API security gateway.

  • The Location header is replaced with a value generated by the API security gateway.

  • If the use-correlation-id-header property is enabled on the HTTP Connection Handler, the gateway adds a correlation ID header to the response. Learn more in Configuring correlation IDs.

  • Headers related to HTTP resource versioning and conditional requests, such as ETag and Last-Modified, are never forwarded.

  • Headers related to CORS, such as Access-Control-Allow-Origin or Access-Control-Allow-Headers, are never forwarded.

Unsupported HTTP request header

The API security gateway doesn’t support the Upgrade header.

Unsupported statement changes

The API security gateway doesn’t support using statements to add, modify, or delete the following headers:

  • Hop-by-hop headers that the gateway always removes, such as Connection and Keep-Alive.

  • Conditional request headers that the gateway always removes, such as If-None-Match and ETag.

  • Proxy-specific headers that the gateway always adds, such as Via and X-Forwarded-For.

The gateway overrides any changes to these headers.