Proxy Headers

When a record is proxied, nsin adds HTTP headers to the request it sends your origin, and a few more to the response. Read them to recover the real visitor, their location, and a request id for troubleshooting.

All nsin headers use the Nsn-* prefix.

Note

These headers are only added on proxied records. DNS-only (“grey-cloud”) records resolve straight to your server and never pass through the nsin edge.

Headers added to the request (nsin → your origin)

Category	Header	Example	Meaning
Visitor IP	Nsn-Connecting-IP	203.0.113.10	The real visitor’s IP. Use this to identify the client.
Visitor IP	X-Forwarded-For	203.0.113.10, 198.51.100.1	Standard proxy chain; the visitor is the first entry.
Visitor IP	X-Real-IP	203.0.113.10	The visitor IP (single value).
Visitor IP	Forwarded	for="203.0.113.10";host="...";proto=https	RFC 7239 structured form.
Protocol & host	X-Forwarded-Proto	https	Protocol the visitor used. Use it to enforce HTTPS / build absolute URLs.
Protocol & host	X-Forwarded-Host	app.example.com	The hostname the visitor requested.
Protocol & host	X-Forwarded-Port	443	The port the visitor connected on.
Geolocation	Nsn-Country	NL	Two-letter ISO country code. XX when unknown.
Geolocation	Nsn-Continent	EU	Continent code (AF, AS, EU, NA, OC, SA, AN). Omitted when unknown.
Tracing	Nsn-Ray	8e9c123456789abc	Unique request id. Log it to correlate a request across systems.
Tracing	Nsn-Edge	EDGES	The nsin PoP (edge) that handled the request.
Tracing	CDN-Loop	nsin	Loop-prevention marker (RFC 8586). A request that re-enters the nsin edge already carrying nsin is rejected — don’t point your origin back at nsin.

Prefer Nsn-Connecting-IP: unlike the X-Forwarded-* family, another proxy in front of your origin can’t overwrite it with its own value.

The upstream Host header is the visitor’s requested hostname (e.g. api.example.com for a wildcard record, not *), unless you set a Host Header Override on the record.

Geolocation is best-effort and network-dependent. No city, region, postal code, coordinates, or timezone.

Caution

Only trust these headers on traffic that actually came from the nsin edge. Block direct access to your origin (or allow only nsin’s IPs) so a client can’t spoof them.

Headers added to the response (nsin → visitor)

Header	Example	Meaning
Nsn-Ray	8e9c123456789abc	Same request id as above, returned to the visitor for support/debugging.
Nsn-Edge	EDGES	The nsin PoP that served the request.
Nsn-Cache-Status	HIT	How the cache handled the request.
Nsn-Cache-Rule	default	Present when the request was handled by nsin’s default static caching rather than one of your cache rules; Nsn-Cache-Status still says whether it was a HIT, MISS or BYPASS.
Server	NSIN	Identifies the nsin edge.

Nsn-Cache-Status values:

Value	Meaning
HIT	Served from the nsin cache; your origin was not contacted.
MISS	Not in cache; fetched from your origin (and may now be cached).
BYPASS	Cache deliberately skipped (e.g. cookies, authorization, or a cache rule).
DYNAMIC	Not cacheable — served straight from origin.

Reading the real visitor IP

Point your framework or reverse proxy at the connecting-IP header. nginx:

real_ip_header Nsn-Connecting-IP;
# set_real_ip_from <nsin edge IPs>;  # only trust the header from nsin

See also Domain Modes for proxied vs. DNS-only records, and Security Headers for the optional response headers you can enable per domain.