Edge Security Acceleration:Managed transform

How it works

When you enable a managed transform, ESA adds a set of common origin request and security response headers at a point of presence (POP). The workflow is as follows:

• HTTP request headers (Client → ESA → Origin server): When a point of presence (POP) receives a client request, it adds specific HTTP request headers as configured before forwarding the request to your origin server. These headers include the following:

  Type	Included header	Description
  Add real client IP header	ali-real-client-ip	Records the real client IP address of the client that established the TCP connection. This header is added by ESA at the point of presence (POP) and is more trustworthy than the X-Forwarded-For header, which can be spoofed by clients.
  Add visitor location headers	ali-ip-country ali-ip-city	Based on the real client IP, ESA queries the IP geolocation database and adds the corresponding country/region and city codes as header values. The header value uses the two-letter Alpha-2 country/region code defined in ISO 3166-1. For example, ali-ip-country=cn indicates that the client IP geolocation is in the Chinese mainland.
  Add security request headers	Tls-Hash Tls-Ja3 Tls-Ja4	Analyzes the client's TLS handshake information to generate JA3 and JA4 fingerprints. These fingerprints help identify client types or detect bots. The headers include Tls-Hash, Tls-Ja3, and Tls-Ja4. The TLS fingerprint headers are populated only for websites on the enterprise plan.
  Account security risk information	Esa-User-Risk	After you enable the Account Security (ATO) feature, requests automatically send account security risk information to the origin server. This includes the account identifier and a risk score. For example, account_name:test2***@gmail.com;risk_coefficient:85 indicates that the account name is test****@gmail.com and the risk score is 85. This header does not need to be manually configured on the Managed Transforms page. The system automatically adds it to the origin request after you enable the Account Security feature.

• HTTP response headers (ESA → Client): When ESA receives a response from the origin server, it adds a set of standard security response headers based on your configuration before returning the response to the client.

  Note

  If a response from your origin server already includes a security header with the same name, ESA overwrites the header value from the origin server by default to ensure policy consistency.

  Type	Included header	Description
  Add security response headers	x-content-type-options: nosniff	Prevents MIME-type confusion attacks by requiring the browser to strictly follow the Content-Type declared in the response header. The nosniff value enables this strict mode.
  	x-xss-protection: 1; mode=block	Protects against reflected cross-site scripting (XSS) attacks, where malicious scripts are injected through URL parameters. The value 1 enables the XSS filter. The value mode=block prevents the page from rendering if the filter is triggered.
  	x-frame-options: SAMEORIGIN	Restricts how pages can be embedded to protect against clickjacking attacks. The value SAMEORIGIN allows embedding only by pages from the same origin. For example, a page from example.com can be framed only by other pages on example.com.
  	referrer-policy: same-origin	Controls Referer header leakage to avoid exposing user navigation paths in cross-origin requests. The value same-origin sends the full Referer only for same-origin requests. No Referer is sent for cross-origin requests.
  	expect-ct: max-age=86400, enforce	This header helps detect non-compliant certificates. The value max-age=86400 sets the policy's validity period to 24 hours. The value enforce requires the browser to reject connections that do not meet Certificate Transparency requirements.

Configure client information for request analysis

This feature automatically adds HTTP headers with the real client IP, geolocation, and TLS fingerprint to origin requests, providing more client context for your application.

Configure security response headers

This feature automatically adds standard security headers to client responses to defend against attacks like XSS and clickjacking, enhancing your web application's security.