CloudFront Headers

You can use HTTP headers, or values attached to HTTP requests and responses, for the client and server to pass additional information. When you are trying to diagnose issues with a web-based technology like CloudFront, the information in these headers can be relevant and helpful.

Access-Control-Allow-Origin

CloudFront allow wildcards in Access-Control-Allow-Origin

• The wildcard character (*) is allowed as the leftmost subdomain (*.example.org).
• The wildcard character (*) isn’t allowed in the following positions:
  • Top-level domains (example.*)
  • To the right of subdomains (test.*.example.org) or within any subdomains (*test.example.org)
  • Inside of terms (exa*mple.org)

The example table from AWS docs:

Example	Will match	Will not match
http://*.example.org	http://www.example.org http://test.example.org	https://test.example.org https://test.example.org:123 http://test.example.org:123
*.example.org	test.example.org test.test.example.org .example.org http://test.example.org https://test.example.org	http://test.example.org:123 https://test.example.org:123
example.org	http://example.org https://example.org
http://example.org		https://example.org http://example.org:123
http://example.org:*	http://example.org:123 http://example.org
http://example.org:1*3	http://example.org:123 http://example.org:1893 http://example.org:13
*.example.org:1*	test.example.org:123

X-Cache

This header tells us if the response was served from the cache (cache hit) or not (cache miss).

Possible values

• Hit from CloudFront
  • The response was served from the CloudFront cache.
• Miss from CloudFront
  • Server forwarded the request to the origin
  • Returned the result to the viewer.
• RefreshHit from CloudFront
  • The CloudFront server found the object in the cache
  • but the object had expired
  • Server contacted the origin to verify that the cache had the latest version of the object
• Redirect from CloudFront
  • The server redirected the viewer from HTTP to HTTPS
    • According to the distribution settings.
• Error from CloudFront
  • Typically this means the request resulted in either
    • a client error
    • a server error

X-Amz-Cf-Id

This response header is an opaque string that uniquely identifies a request. The header is alternatively referred to as the CloudFront Request ID.

It is important if you need to later:

• identify a request in your CloudFront access logs
• open a support case with AWS Premium Support

CloudFront also sends this header in requests made to your origin.

For troubleshooting issues with a custom origin, you should consider logging these headers at the origin if you are not already doing so.

X-Amz-Cf-Pop

This is the edge location that served the request. Each edge location is identified by a three-letter code and an arbitrarily assigned number, such as DFW3.

The three-letter code typically corresponds with the International Air Transport Association (IATA) airport code for an airport near the edge location’s geographic location.