security
Client IP trust and request limits.
security.client_ip_header
Section titled “security.client_ip_header”Type: auto · x-forwarded-for · x-real-ip · cf-connecting-ip · Default: auto
Where the real client IP comes from.
auto:CF-Connecting-IPwhen the peer is in Cloudflare’s ranges, otherwise the right-most untrustedX-Forwarded-Forentry.x-forwarded-for: Right-most untrustedX-Forwarded-Forentry.x-real-ip:X-Real-IPfrom a trusted proxy.cf-connecting-ip:CF-Connecting-IPfrom a trusted proxy (Cloudflare’s edge or a listed network); needscloudflareintrusted_proxies.
security.limits
Section titled “security.limits”Type: object · Default: see the fields below
Request size limits.
security.limits.max_body_bytes
Section titled “security.limits.max_body_bytes”Type: ByteSize
Request body size, also enforced for chunked bodies. Unlimited when omitted.
security.limits.max_header_bytes
Section titled “security.limits.max_header_bytes”Type: ByteSize · Default: 64KiB
Total size of the request line and headers.
security.limits.max_headers
Section titled “security.limits.max_headers”Type: integer · Default: 100
Number of request headers.
security.limits.max_uri_bytes
Section titled “security.limits.max_uri_bytes”Type: ByteSize · Default: 8KiB
Request target (path and query) length.
security.trusted_proxies
Section titled “security.trusted_proxies”Type: list of TrustedProxy
Proxies whose forwarded headers are believed. Headers from anyone else are replaced.