Origin connection: the real visitor IP, locking down your origin, WebSocket and timeouts

Checks

• The real visitor IP arrives in the X-CDN-Client-IP header. It holds a single value and the edge server rewrites it on every request; a header of the same name sent by the visitor is not used. The value can also be an IPv6 address.
• Edge servers also send X-Real-IP and X-Forwarded-For. If you use X-Forwarded-For, take the rightmost value, not the first; the visitor can write the values on the left.
• Headers sent to your origin are set per rule: one header per line, in the form Header-Name value. When you add a new rule, add the secret header to it too; otherwise your origin rejects that rule's requests.
• Make the secret header's value a random value of at least 32 characters, letters and digits only. On rules that connect to your origin over HTTPS, the header travels encrypted.
• Rely on the secret header rather than locking your origin with an IP list alone. We tell you the current addresses of the edge servers linked to your account on request.
• On a rule with Allow WebSocket connections on, connections reach your origin and stay open while data flows; responses on that path are not cached. WebSocket cannot be switched on in a rule that optimizes images, so create a separate rule for the WebSocket path.
• The origin response timeout is 60 seconds by default: if your origin sends no data for 60 seconds, the request ends with a 504 error and an idle WebSocket connection closes. You can set it per rule between 1 and 3,600 seconds. As long as data flows, there is no limit on the total length of a connection.
• On the domain of your Managed Container apps, WebSocket is on by default and the timeout is 300 seconds unless the rule sets another value.
• With WAF on, GET, HEAD, POST and OPTIONS are allowed by default. The JavaScript challenge applies only to page requests from browsers and does not affect API requests.