Infrastructure and disclosure

Via HTTP Header

Lists intermediary protocols and hosts through which the message has been forwarded.

Applicability

This field applies to both HTTP requests and responses.

Syntax

Via: <received-protocol> <received-by>[, ...]

Examples

Via: 1.1 proxy.example
Via: 1.0 edge-a, 1.1 gateway-b

Common use cases

  • Diagnose loops and protocol transitions across cooperating intermediaries.
  • Identify which gateway path processed a response without exposing unnecessary internal detail.

Common mistakes

  • Treating Via as a general server product banner rather than intermediary trace metadata.
  • Removing required forwarding information without considering loop detection and organizational privacy rules.

Security considerations

Via can expose network topology, so pseudonyms and careful detail are appropriate, while protocol compliance and loop prevention must be preserved.

Detailed guidance

Meaning and behavior

Via is a standard HTTP field added by forwarding proxies and gateways to describe protocol handling along a message path. Each entry contains a received protocol version and an identifier for the intermediary, optionally with a comment. Entries are ordered as the message travels, allowing recipients and intermediaries to recognize forwarding chains and diagnose loops. The identifier may be a host, port, or pseudonym when revealing an internal address would be inappropriate.

Via is not the same as Server. Server describes software associated with an origin response, while Via records forwarding participants and protocol versions. It also is not a complete network trace: organizations can combine entries under defined conditions, use pseudonyms, and hide details for privacy. Different scanner locations may traverse different edges and therefore observe different values.

Implementation notes

Configure forwarding components according to RFC 9110 and the organization’s disclosure policy. Preserve enough information for loop detection and protocol diagnostics, but avoid comments containing product versions, private hostnames, or environment names unless they are operationally necessary. Test multi-proxy routes, retries, cached responses, WebSocket or upgrade paths, and error generation. If a gateway strips upstream Via entries, confirm that doing so does not violate interoperability expectations or hide a routing loop. Correlate the field with internal traces rather than treating public identifiers as authoritative topology. Review both requests and responses because Via can appear in either direction.

Sources