---
schema_version: "1"
id: 02222d4f28e5c02648982547e9fbd7621a0052809e7394b597b42e9abeb62d34
title: Trusted Proxies and eCDN Request Blocking
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_verify_third_party_requests.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_verify_third_party_requests.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1e5f72e2706feb96146d8f7ff9cfbdf2a9caef9a45663c5349bf932db2f9a694
description: When you stack a third-party CDN or proxy in front of B2C Commerce eCDN, the eCDN security feature can mistake the proxy for an attacker and block it. Verify trusted proxy traffic so that legitimate requests aren't blocked.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Trusted Proxies and eCDN Request Blocking

When you stack a third-party CDN or proxy in front of B2C Commerce eCDN, the eCDN security feature can mistake the proxy for an attacker and block it. Verify trusted proxy traffic so that legitimate requests aren't blocked.

[Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US)

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note Create the custom rule on the eCDN zone that fronts the traffic: a storefront zone, the Default Domain, or the SCAPI zone. Custom rules, including secret header checks, are available on all three. There's one SCAPI zone for Development, Staging, and Production. Configure it only from the Production instance. It doesn't appear in Business Manager or the CDN API on Development or Staging. Scope every SCAPI rule by the org ID in the URL path so that it doesn't affect other environments. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required."), [Default Domain Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_default_domain.htm&release=264.0.0&type=5 "Default Domain is a Salesforce-managed, eCDN-enabled hostname provided for each B2C Commerce instance (development, staging, and production), so you can test without manual DNS, custom domain registration, or certificate management. Use the Default Domain for developer testing, load testing, and preproduction review, whether you're working alongside an existing custom branded domain (for example, www.example.com) or haven't set one up yet."), and [Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 "Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters.").

Because all traffic from a stacked third-party proxy reaches eCDN from the proxy's IP addresses, the eCDN security feature can incorrectly identify that proxy as an offending IP address or server. This misidentification can happen, for example, while mitigating a DDoS or application-layer attack. In this case, eCDN blocks the third-party server and affects more users than intended.

Salesforce recommends that you use eCDN custom rules to selectively allow traffic from your trusted proxy without disabling eCDN protections for everyone else. Implement this approach using [eCDN custom rules](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-custom-rules.html) (per zone) to selectively skip the web application firewall (WAF), other custom rules, rate limits, or security levels for specific third-party IP addresses.

Custom rules use a secret extra HTTP header to verify requests. The header is typically attached at the CDN level, and it identifies traffic from your trusted proxy. For example:

```
x-extra_header_name: extra_header_value
```

To verify incoming requests, an eCDN custom rule checks for the header and blocks malicious traffic that doesn't include it. All requests that fail the header check return a 403 response code. See [eCDN Custom Rule](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-custom-rules.html).

You can also add the trusted proxy to the firewall allowlist, but Salesforce doesn’t recommend this method since it bypasses all DDoS and WAF components, including all custom rules, rate limiting rules, and managed rules. If you must use the allowlist approach, add the third-party proxy IP address to a Managed IP Address List, and reference that list in a Custom Firewall Rule with a skip action. For instructions, see [Manage IP Address Lists for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_manage_trusted_ip_address_lists.htm&release=264.0.0&type=5 "Create named lists of trusted IP addresses or CIDR ranges to use with custom firewall rules that bypass security checks for trusted traffic on your B2C Commerce storefront.").