---
title: API security gateway HTTP 1.1 support
description: As a reverse proxy, the API security gateway modifies HTTP requests and responses in addition to the changes required by policy processing.
component: pingauthorize
version: 11.1
page_id: pingauthorize:pingauthorize_server_administration_guide:paz_api_security_gw_http_support
canonical_url: https://docs.pingidentity.com/pingauthorize/11.1/pingauthorize_server_administration_guide/paz_api_security_gw_http_support.html
llms_txt: https://docs.pingidentity.com/pingauthorize/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: June 26, 2026
section_ids:
  forwarded-http-request-headers: Forwarded HTTP request headers
  forwarded-http-response-headers: Forwarded HTTP response headers
  unsupported-http-request-header: Unsupported HTTP request header
  unsupported-statement-changes: Unsupported statement changes
---

# API security gateway HTTP 1.1 support

As a reverse proxy, the API security gateway modifies HTTP requests and responses in addition to the changes required by policy processing.

## Forwarded HTTP request headers

HTTP requests often pass through several intermediaries before reaching their destination server. [HTTP 1.1](https://www.rfc-editor.org/rfc/rfc9110.html#section-7.6.1) defines two relevant types of headers:

* End-to-end headers

  Headers requiring transmission to all recipients on the chain, such as `Content-Type`.

* Hop-by-hop headers

  Headers that are only relevant to the next recipient on the chain, such as `Connection` and `Keep-Alive`.

  The API security gateway never forwards hop-by-hop headers. It forwards all end-to-end headers, with the following exceptions:

  * Headers related to HTTP resource versioning and conditional requests, such as `If-None-Match` and `If-Modified-Since`, are never forwarded.

  * Headers related to CORS, such as `Origin` or `Access-Control-Request-Method`, are never forwarded.

  * Headers that you exclude by using the `allowed-headers` configuration property of an API External Server to define an allow list of forwarded headers.

  * Headers that you remove by using a custom statement extension.

The API security gateway always adds the `Host`, `Accept-Encoding`, `Via`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Port`, and `X-Forwarded-Proto` headers to forwarded requests. If the `use-correlation-id-header` property is enabled on the HTTP Connection Handler, the gateway also adds a correlation ID header to the forwarded request. Learn more in [Configuring correlation IDs](paz_config_corr_id.html).

You can use the `http-auth-evaluation-behavior` property of a Gateway API Endpoint to alter the `Authorization` header of a forwarded request.

## Forwarded HTTP response headers

The API security gateway forwards most HTTP response headers, with the following exceptions:

* The `Date` header is replaced with a value generated by the API security gateway.

* The `Content-Length` header is replaced with a value generated by the API security gateway.

* The `Location` header is replaced with a value generated by the API security gateway.

* If the `use-correlation-id-header` property is enabled on the HTTP Connection Handler, the gateway adds a correlation ID header to the response. Learn more in [Configuring correlation IDs](paz_config_corr_id.html).

* Headers related to HTTP resource versioning and conditional requests, such as `ETag` and `Last-Modified`, are never forwarded.

* Headers related to CORS, such as `Access-Control-Allow-Origin` or `Access-Control-Allow-Headers`, are never forwarded.

## Unsupported HTTP request header

The API security gateway doesn't support the `Upgrade` header.

## Unsupported statement changes

The API security gateway doesn't support using statements to add, modify, or delete the following headers:

* Hop-by-hop headers that the gateway always removes, such as `Connection` and `Keep-Alive`

* Conditional request headers that the gateway always removes, such as `If-None-Match` and `ETag`

* Proxy-specific headers that the gateway always adds, such as `Via` and `X-Forwarded-For`

The gateway overrides any changes to these headers.