Request headers

Region ID

TheREGION_ID is an abbreviated code that Google assignsbased on the region you select when you create your app. The code does notcorrespond to a country or province, even though some region IDs may appearsimilar to commonly used country and province codes. For apps created after February 2020,REGION_ID.r is included in App Engine URLs. For existing apps created before this date, the region ID is optional in the URL.

Learn moreabout region IDs.

Use this reference page for details about what HTTP headers are supported. To understand how App Engine receivesrequests and sends responses, seeHow Requests AreHandled.

Request headers

An incoming HTTP request includes the HTTP headers sent by the client. Forsecurity purposes, some headers are sanitized, amended, or removed byintermediate proxies before they reach the application.

Headers removed from incoming requests

The following headers are removed from incoming requests if a client sends them:

  • Headers with names that match theX-Google-* pattern. This name patternis reserved for Google.

  • Headers with names that matchApp Engine-specific headers. Onlyexact, case-insensitive matches are removed. For example, headers namedX-Appengine-Country orX-AppEngine-Country will be removed butX-Appengine-Cntry will not.

App Engine-specific headers

As a service to the app, App Engine adds the following headers to all requests:

X-Appengine-Country
Country from which the request originated, as anISO 3166-1alpha-2 country code.App Engine determines this code from the client's IP address. Note thatthe country information is not derived from the WHOIS database; it's possiblethat an IP address with country information in the WHOIS database will not havecountry information in theX-Appengine-Country header. Your application shouldhandle the special country codeZZ (unknown country).
X-Appengine-Region
Name of region from which the request originated. This value only makessense in the context of the country inX -Appengine-Country. For example, ifthe country is "US" and the region is "ca", that "ca" means "California", notCanada. The complete list of valid region values is found in theISO-3166-2 standard.
X-Appengine-City
Name of the city from which the request originated. For example, a requestfrom the city of Mountain View might have the header valuemountain view.There is no canonical list of valid values for this header. If the city can'tbe resolved, the header value is set to?.
X-Appengine-CityLatLong
Latitude and longitude of the city from which the request originated. Thisstring might look like "37.386051,-122.083851" for a request from Mountain View.If the city can't be resolved, the header value is set to0.000000,0.000000.
X-Cloud-Trace-Context
A unique identifier for the request used forCloud TraceandCloud Logging. There isn't an option to disable this headeror choose the sampling rate for tracing since all App Engine standard environment apps are tracedautomatically.
X-Forwarded-For: [CLIENT_IP(s)], [global forwarding rule IP]

A comma-delimited list of IP addresses through which the client request hasbeen routed. The first IP in this list is generally the IP of the client thatcreated the request. The subsequent IPs provide information about proxy serversthat also handled the request before it reached the application server. Forexample:

X-Forwarded-For: clientIp, proxy1Ip, proxy2Ip
X-Forwarded-Proto [http | https]

Showshttp orhttps based on the protocol the client used to connect toyour application.

The Google Cloud Load Balancer terminates allhttps connections, and thenforwards traffic to App Engine instances overhttp. For example, if a userrequests access to your site viahttps://PROJECT_ID.REGION_ID.r.appspot.com, the X-Forwarded-Proto header value ishttps.

In addition, App Engine may set the following headers which are forinternal use by App Engine:

  • X-Appengine-Https
  • X-Appengine-User-IP
  • X-Appengine-Api-Ticket
  • X-Appengine-Request-Log-Id
  • X-Appengine-Default-Version-Hostname
  • X-Appengine-Timeout-Ms

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.