Skip to content

Document blocked headers for WebSocket Playground proxy #4163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devin-ai-integration wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Document blocked headers for WebSocket Playground proxy #4163

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions fern/products/docs/pages/api-references/api-explorer.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,22 @@ For APIs that support WebSocket connections, the API Explorer includes a **WebSo

<div style="position: relative; padding-bottom: 56.2%; height: 0;"><iframe src="https://www.loom.com/embed/be4da30404794e9983c4fe639f78d4c8?sid=73b7aeda-98fa-4531-87ed-1e5909500fe2?hide_owner=true&hide_share=true&hide_title=true&hideEmbedTopBar=true" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div>

### Blocked headers

The WebSocket proxy strips certain headers during the connection handshake for security. Custom headers defined in your API definition (such as authentication headers) are forwarded normally. The following headers are blocked:

<Accordion title="Blocked header list">
- `Host`, `Origin`, `Referer`
- `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Forwarded-Port`, `Forwarded`
- `X-Real-IP`, `True-Client-IP`
- `Connection`, `Keep-Alive`, `Transfer-Encoding`, `TE`, `Trailer`, `Via`
- `Upgrade`
- `Proxy-Authorization`, `Proxy-Connection`
- `Cookie`, `Set-Cookie`
- `X-Request-Id`
- Cloudflare headers: `CF-Connecting-IP`, `CF-IPCountry`, `CF-Ray`, `CF-Visitor`
</Accordion>

## Control API Explorer availability

For OpenAPI specs, the API Explorer is enabled by default for all endpoints. You can disable it globally or per endpoint using the [`x-fern-explorer`](/learn/api-definitions/openapi/extensions/api-explorer-control) extension. This is commonly used to disable the Explorer for destructive operations, payment processing, or admin-only endpoints.