Request and response headers

Easel adds a small set of headers to requests your code receives and to responses it returns. Depend only on the headers listed here. Other internal headers can change and are removed before they reach you.

Request headers

These are set by Easel on requests that reach your function. Easel overwrites any client-supplied value, so you can trust them.

Use X-Forwarded-Host for canonical URLs and auth callbacks, and validate it against your own domains before building security-sensitive URLs. Treat X-Forwarded-For as proxy metadata, not proof of a client's identity. Use environment variables, not these headers, for configuration.

These headers exist only on deployed requests, not in local development, and only when the request reaches a function.

export async function GET(request: Request) {
  return Response.json({
    requestId: request.headers.get("x-easel-id"),
    environment: request.headers.get("x-easel-deployment-environment"),
  });
}

In Next.js, read them with headers() from next/headers.

Response headers

X-Robots-Tag keeps previews out of search results but doesn't restrict access. Use deployment protection for that. The firewall headers are for your own diagnostics; see Firewall. A challenge is served as a 429 HTML page with Cache-Control: no-store; see Attack challenge mode.

Headers Easel changes

• CDN-Cache-Control and Vercel-CDN-Cache-Control are consumed and removed.
• Cache-Control containing s-maxage is rewritten for browsers. See Caching.
• Server-Timing is replaced with Easel's own timings.
• Hop-by-hop headers, such as Connection, Keep-Alive, and Transfer-Encoding, apply to one connection and aren't forwarded.

Custom headers

Return your own headers from your code or set them in framework configuration. Use your own prefix, such as X-My-App-Version. Don't set the headers listed on this page; Easel replaces or removes them.

Headers show up in logs and traces. Don't put secrets or personal data in custom headers, and correlate events by X-Easel-Id instead of copying Authorization or Cookie values into logs. Header and URL size limits are in Limits.

Inspect headers

curl -I https://example.com

HTTP/2 200
cache-control: public, max-age=0, must-revalidate
x-easel-id: 3f2b8c1e-6d4a-4f0e-9b7a-2c5d8e1f4a90
x-easel-cache: HIT
content-encoding: br
server: Easel

Use curl -IL to follow redirects and see the headers on each hop.