Question about phases and rule execution

[anders14]

What is the name of the domain?

nda

What is the issue you’re encountering

Unable to add custom header after Access headers are added

What steps have you taken to resolve the issue?

Reading docs

What are the steps to reproduce the issue?

I have a site protected by Access and want a custom header based on the headers that Access adds on all requests going to the site.

Create a request header modification rule.
Add a new header: X-Forwarded-User = http.request.headers[“cf-access-authenticated-user-email”][0]

This does not seem to work.

Reading the documentation it’s unclear if it is supposed to work.
Phases list · Cloudflare Ruleset Engine docs says “HTTP Request Header Modification Rules” are evaluated after “Cloudflare Access”, giving me the impression that this should work.
But on the Rules Overview page the “Traffic sequence” suggests it’s the other way around? Which is it? Can this work?

Screenshot of the error

[ncano]

Access is called before HTTP Request Header Modification Rules phase, we’ll revisit the order in Traffic Sequence UI to make sure it is up-to-date.

However, despite the order of execution, Transform Rules will not be able to retrieve Access header currently, but you can still do this with Snippets or Workers: Create custom headers for Cloudflare Access-protected origins with Workers · Cloudflare Zero Trust docs.