Request Header Variables

You can use request headers in any script with the following script:

request.headers.get('x-sp-%header%')

Additional headers detailing information about the request are present on the event.request object passed to the script. A script can access this information like any other header. For example, the below script returns a 403 when the request is coming from ip 192.168.1.100 and returns normally otherwise:

addEventListener("fetch", event => {
  event.respondWith(handleRequest(event.request));
});

async function handleRequest(request) {
  if (request.headers.get("x-sp-client-ip") !== "192.168.1.100") {
    return new Response("Access Denied", {
      status: 403,
      statusText: "Forbidden"
    });
  }

  return fetch(request);
}

These are all of the headers available to scripts: