Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/.vuepress/sets/craft-cloud.js
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ module.exports = {
title: "Help",
collapsable: false,
children: [
"diagnostics",
"faq",
"troubleshooting",
"security",
Expand Down
4 changes: 4 additions & 0 deletions docs/.vuepress/theme/styles/code.pcss
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,10 @@
}
}

.cloud-diagnostics .theme-default-content code {
white-space: nowrap;
}

/**
* Styling to emphasize placeholders within fenced code blocks.
* (This is something we added to VuePress.)
Expand Down
41 changes: 41 additions & 0 deletions docs/cloud/diagnostics.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
---
description: Diagnose failed requests to Craft Cloud.
pageClass: cloud-diagnostics
---

# Diagnostics

## Response Headers

- `cf-*`: Cloudflare
- `x-gateway-*`: Craft Cloud gateway
- All others: origin (Craft)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Avoid attributing every unprefixed header to Craft

This exhaustive attribution is incorrect for intermediary-generated standard headers. In particular, Craft Cloud's gateway and capacity-limiting paths can emit the unprefixed Retry-After used later on this page, and Cloudflare or the gateway may also add or rewrite fields such as Date, Server, and Content-Length; readers could therefore misidentify the response layer. Restrict this statement to known origin headers instead of treating every non-cf-*/x-gateway-* header as origin data.

Useful? React with 👍 / 👎.


| Response Header | Description |
| --- | --- |
| `x-gateway-flow` | How Craft Cloud produced the response. For example, `/origin/fetch` reached Craft. |
| `x-gateway-http-signature` | [Request-signing](request-signing.md) result. `verified` succeeded; `unverified` was detected but failed validation. |
| `cf-ray` | Cloudflare request ID.<sup>1</sup> |
| `cf-cache-status` | Cloudflare [cache status](static-caching.md#troubleshooting).<sup>1</sup> |
| `x-gateway-cf-ray` | Cloudflare request ID.<sup>2</sup> |
| `x-gateway-cf-cache-status` | Cloudflare [cache status](static-caching.md#troubleshooting).<sup>2</sup> |

<sup>1</sup> With [Cloudflare O2O](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/how-it-works/) requests, the marked headers describe the customer zone.

<sup>2</sup> The marked headers describe the Craft Cloud zone and are only present with [Cloudflare O2O](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/how-it-works/) requests.

## Interpreting Failures

Status alone does not identify the response layer. Use it with the diagnostic
headers:

| Status | Response Headers | Interpretation |
| --- | --- | --- |
| `4xx/5xx` | `x-gateway-flow: /origin/fetch` | Returned by Craft; check application logs. |
| `400/403/413` | `x-gateway-flow: /origin/reject` | Detected invalid or malicious request. |
| `401` | `x-gateway-http-signature: unverified` | The signature was invalid or expired. |
| `404` | `x-gateway-flow: /` | Hostname did not match a Craft Cloud environment. |
| `429/503` | `Retry-After: 𝑛` | Automate retry, honoring `Retry-After`. |

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Limit automatic retries to safe requests

For non-idempotent requests such as GraphQL mutations or form submissions, automatically retrying every 429 or 503 carrying Retry-After can repeat side effects if the first attempt was partially processed. This also conflicts with docs/cloud/headless-apps.md:23-26, which requires bounded retries and permits retrying POST only for read-only queries; qualify this guidance accordingly rather than recommending unconditional automation.

Useful? React with 👍 / 👎.

| `500/502` | No `x-gateway-flow: /origin/fetch` | A gateway error occurred; contact support if it persists. |

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Distinguish absent flow headers from non-origin flows

When a 500 or 502 response has no x-gateway-flow header at all, it matches both this row and the final 5xx row: this row classifies it as a gateway error, while line 41 says it occurred before the gateway. That is precisely a common diagnostic scenario, so require a present non-/origin/fetch flow value here or otherwise make the two conditions mutually exclusive.

Useful? React with 👍 / 👎.

| `504` | `x-gateway-flow: /origin/fetch/error` | The origin exceeded the [request duration limit](quotas.md#requests-responses). |
| `5xx` | No `x-gateway-flow` | The error occurred before the gateway, either in the `craft.cloud` zone or a parent Cloudflare zone. |
Loading