Signed exchanges caveats
Allowed request headers
Signed exchanges remove cookies and headers from HTTP requests, which can create problems with dynamic or personalized content. This is intentional since signed exchanges can be distributed to multiple browsers. Therefore, packaging any personalized or dynamic content into a signed exchange could be a security risk. The only request headers that are not removed are the following:
Since Cloudflare cannot be sure whether a signed exchange includes private information or not, a signed exchange will not be generated in the presence of the following response headers:
Signed exchanges will not be created if the response headers contain a
cache-control header whose value is either:
cache-control=private would mean that a signed exchange is not created.