Sending Custom Header from App Service A to App Service B via Proxy Pass (NGINX + PHP)

Question

Sending Custom Header from App Service A to App Service B via Proxy Pass (NGINX + PHP)

Kanisius Raychitra Lieka Avisena 0

I have 2 Azure App Services. Let's say App Service A and App Service B. Both ran in NGINX and PHP

Any request of /api in App Service A will be forwarded to App Service B via a proxy_pass.

I want to perform a manual verification via a custom header X-Custom like below.

However, it seems the header X-Custom does not reach App Service B (it gets sanitized).

Can someone help me how to do it?

Location ^~ /api {

	proxy_set_header X-Custom "test";

	proxy_pass_request_headers on;

	proxy_pass https://apiwebsite.azurewebsites.net/api;

}

Bhargavi Naragani 1,460 Reputation points Microsoft External Staff

2025-02-24T09:17:07.6666667+00:00
Hi @Kanisius Raychitra Lieka Avisena,

It seems like you’re running into a common issue with custom headers where App Service A proxies the request to App Service B through proxy_pass and the custom header X-Custom isn't reaching App Service B. This is because Azure App Service has a default list of allowed headers, and non-standard headers tend to get sanitized or stripped in some cases.

You can ensure your custom header reaches App Service B by modifying the NGINX config and ensuring that the header is permitted and properly passed through. Have a try with this modified config:

location ^~ /api { proxy_set_header X-Custom "test"; proxy_pass_request_headers on; # Forwarding real client IP and host info (optional) proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # Ensure the connection uses HTTPS if required proxy_pass https://apiwebsite.azurewebsites.net/api; }

Additionally, ensure that App Service B is configured to permit and see the X-Custom header. Azure App Services might sometimes deny non-standard headers unless specifically allowed.

App Service B Config check:

Navigate to App Service B in the Azure portal.

Under Settings, select Configuration > General Settings.

Ensure WebSockets and ARR Affinity are off, they can sometimes interfere with headers.

If you’re using PHP, make sure your code is capturing the custom header like this:

$customHeader = $_SERVER['HTTP_X_CUSTOM'] ?? 'Header not received'; echo $customHeader;

Reference:
Configure a reverse proxy server
Configure a PHP app for Azure App Service

Hope the above provided information help in better understanding and help you resolve the issue, if you have any further concerns or queries, please feel free to reach out to us.
If the answer is helpful, kindly Upvote it.
Kanisius Raychitra Lieka Avisena 0 Reputation points

2025-02-25T01:11:36.5133333+00:00

Hi Bhargavi, thank you for the reply! Let me try your suggestion and get you back the result. :)
Bhargavi Naragani 1,460 Reputation points Microsoft External Staff

2025-02-26T01:33:14.07+00:00

Hi @Kanisius Raychitra Lieka Avisena,
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Kanisius Raychitra Lieka Avisena 0 Reputation points

2025-02-26T04:07:48.03+00:00

Hi Bhargavi, it does not work.

I also do not see the rationale adding below line will help after I read NGINX docs. Because thats the only difference I have between my previous nginx config with yours.

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

May I seek your explanation why above will help my case?
Bhargavi Naragani 1,460 Reputation points Microsoft External Staff

2025-02-27T00:43:52.6233333+00:00

Hi @Kanisius Raychitra Lieka Avisena,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Bhargavi Naragani 1,460 Reputation points Microsoft External Staff

2025-02-28T00:44:32.4533333+00:00

Hi @Kanisius Raychitra Lieka Avisena,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Kanisius Raychitra Lieka Avisena 0 Reputation points

2025-02-28T22:48:13.8233333+00:00

Hi Bhargavi, give me some time to test. It does not show any result yet, I still cannot find the header.
Kantamsetti Aslesha 80 Reputation points Microsoft External Staff

2025-03-13T07:42:41.17+00:00
Hi @Kanisius Raychitra Lieka Avisena
If you're still not receiving the X-Custom header on App Service B. Here are a few additional checks that might help:

Confirm Header is Being Sent from App Service A Before debugging further, let’s verify that App Service A is actually sending the header. Run the following command from App Service A’s terminal (via SSH or a test script):
curl -H "X-Custom: test" -v https://apiwebsite.azurewebsites.net/api
This should confirm if the header is included in the request.

Check Headers Received by App Service B On App Service B, modify your PHP script to log all incoming headers:
file_put_contents('headers.log', print_r(getallheaders(), true));
Then check the headers.log file to see if X-Custom is being stripped or renamed.

Try a Different Header Name Azure might be sanitizing the X-Custom header. Instead, try renaming it to something like:
proxy_set_header X-AppService-Custom "test";
Then retrieve it in PHP:
$customHeader = $_SERVER['HTTP_X_APPSERVICE_CUSTOM'] ?? 'Header not found'; echo $customHeader;

Check for Middleware Stripping Headers Some PHP frameworks (Laravel, Symfony, etc.) or security modules might be removing unknown headers. If you’re using such a framework, try checking the request headers inside your application’s middleware.

Use Query Parameters as a Temporary Workaround If all else fails, you can pass the value as a query parameter:

proxy_pass https://apiwebsite.azurewebsites.net/api?customHeader=test;

And retrieve it in PHP:

$customHeader = $_GET['customHeader'] ?? 'Header not found';

Could you try these steps and let me know.
Kantamsetti Aslesha 80 Reputation points Microsoft External Staff

2025-03-14T04:46:33.46+00:00

Hi @Kanisius Raychitra Lieka Avisena
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.

1 answer

Your answer

Bhargavi Naragani 1,460 Reputation points Microsoft External Staff

2025-02-24T09:17:07.6666667+00:00

Hi @Kanisius Raychitra Lieka Avisena,

It seems like you’re running into a common issue with custom headers where App Service A proxies the request to App Service B through proxy_pass and the custom header X-Custom isn't reaching App Service B. This is because Azure App Service has a default list of allowed headers, and non-standard headers tend to get sanitized or stripped in some cases.

You can ensure your custom header reaches App Service B by modifying the NGINX config and ensuring that the header is permitted and properly passed through. Have a try with this modified config:

location ^~ /api { proxy_set_header X-Custom "test"; proxy_pass_request_headers on; # Forwarding real client IP and host info (optional) proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # Ensure the connection uses HTTPS if required proxy_pass https://apiwebsite.azurewebsites.net/api; }

Additionally, ensure that App Service B is configured to permit and see the X-Custom header. Azure App Services might sometimes deny non-standard headers unless specifically allowed.

App Service B Config check:

Navigate to App Service B in the Azure portal.

Under Settings, select Configuration > General Settings.

Ensure WebSockets and ARR Affinity are off, they can sometimes interfere with headers.

If you’re using PHP, make sure your code is capturing the custom header like this:

$customHeader = $_SERVER['HTTP_X_CUSTOM'] ?? 'Header not received'; echo $customHeader;

Reference:
Configure a reverse proxy server
Configure a PHP app for Azure App Service

Hope the above provided information help in better understanding and help you resolve the issue, if you have any further concerns or queries, please feel free to reach out to us.
If the answer is helpful, kindly Upvote it.
Kanisius Raychitra Lieka Avisena 0 Reputation points

2025-02-25T01:11:36.5133333+00:00

Hi Bhargavi, thank you for the reply! Let me try your suggestion and get you back the result. :)
Bhargavi Naragani 1,460 Reputation points Microsoft External Staff

2025-02-26T01:33:14.07+00:00

Hi @Kanisius Raychitra Lieka Avisena,
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Kanisius Raychitra Lieka Avisena 0 Reputation points

2025-02-26T04:07:48.03+00:00

Hi Bhargavi, it does not work.

I also do not see the rationale adding below line will help after I read NGINX docs. Because thats the only difference I have between my previous nginx config with yours.

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

May I seek your explanation why above will help my case?
Bhargavi Naragani 1,460 Reputation points Microsoft External Staff

2025-02-27T00:43:52.6233333+00:00

Hi @Kanisius Raychitra Lieka Avisena,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Bhargavi Naragani 1,460 Reputation points Microsoft External Staff

2025-02-28T00:44:32.4533333+00:00

Hi @Kanisius Raychitra Lieka Avisena,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Kanisius Raychitra Lieka Avisena 0 Reputation points

2025-02-28T22:48:13.8233333+00:00

Hi Bhargavi, give me some time to test. It does not show any result yet, I still cannot find the header.
Kantamsetti Aslesha 80 Reputation points Microsoft External Staff

2025-03-13T07:42:41.17+00:00

Hi @Kanisius Raychitra Lieka Avisena
If you're still not receiving the X-Custom header on App Service B. Here are a few additional checks that might help:

Confirm Header is Being Sent from App Service A Before debugging further, let’s verify that App Service A is actually sending the header. Run the following command from App Service A’s terminal (via SSH or a test script):
curl -H "X-Custom: test" -v https://apiwebsite.azurewebsites.net/api
This should confirm if the header is included in the request.

Check Headers Received by App Service B On App Service B, modify your PHP script to log all incoming headers:
file_put_contents('headers.log', print_r(getallheaders(), true));
Then check the headers.log file to see if X-Custom is being stripped or renamed.

Try a Different Header Name Azure might be sanitizing the X-Custom header. Instead, try renaming it to something like:
proxy_set_header X-AppService-Custom "test";
Then retrieve it in PHP:
$customHeader = $_SERVER['HTTP_X_APPSERVICE_CUSTOM'] ?? 'Header not found'; echo $customHeader;

Check for Middleware Stripping Headers Some PHP frameworks (Laravel, Symfony, etc.) or security modules might be removing unknown headers. If you’re using such a framework, try checking the request headers inside your application’s middleware.

Use Query Parameters as a Temporary Workaround If all else fails, you can pass the value as a query parameter:

proxy_pass https://apiwebsite.azurewebsites.net/api?customHeader=test;

And retrieve it in PHP:

$customHeader = $_GET['customHeader'] ?? 'Header not found';

Could you try these steps and let me know.
Kantamsetti Aslesha 80 Reputation points Microsoft External Staff

2025-03-14T04:46:33.46+00:00

Hi @Kanisius Raychitra Lieka Avisena
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.

Answer 1

Hi @Kanisius Raychitra Lieka Avisena,

It seems like you're still experiencing problems with the X-Custom header not being delivered to App Service B, and you're looking for an explanation about the need for the extra proxy_set_header commands.

proxy_set_header Host $host; It sets the original host requested from the client for the Host header in the request forwarded to. It's required when the Host header is the basis for which the backend server (App Service B) can serve content rightly.

proxy_set_header X-Real-IP $remote_addr; It sends the IP of the client over to the backend server through the X-Real-IP header. It may be used where logging or access controls based on IP are enforced on App Service B.

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; This adds the client's IP address to the X-Forwarded-For header, which keeps track of the IPs the request has passed through. It's widely utilized for recording the original client IP across proxy chains.

Although these headers are helpful for maintaining client data and verifying the backend server processes requests appropriately, they aren't directly impacting the delivery of custom headers such as X-Custom.

As the problem is still ongoing, try the following steps:
Make sure your NGINX configuration on App Service A contains the X-Custom header:

location ^~ /api/ {
    proxy_set_header X-Custom "test";
    proxy_pass https://apiwebsite.azurewebsites.net/api/;
}

Observe the trailing slashes in the location and proxy_pass directives, which ensure the correct URI structure.

Verify that App Service B is set up to receive and handle the X-Custom header. In PHP, you can get the header with the following code, this code looks for the X-Custom header and prints its value:

$customHeader = $_SERVER['HTTP_X_CUSTOM'] ?? 'Header not received';
echo $customHeader;

Some middlewares or frameworks may remove unknown headers for security purposes. Make sure that whatever middleware is being used in App Service B can forward the X-Custom header.

If you're working with Azure Application Gateway, it's possible to make it rewrite HTTP headers so you can add or replace headers based on your requirements. This will help make sure that the X-Custom header is not removed when forwarding the requests. For more information, refer thishttps://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url

Overview:
https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/
https://learn.microsoft.com/en-us/azure/frontdoor/front-door-http-headers-protocol

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

Sending Custom Header from App Service A to App Service B via Proxy Pass (NGINX + PHP)

1 answer

Your answer