CloudFront can now tell an origin the viewer's ISP and whether TLS used PQC
Serguey Asael Shinder1 min readAmazon CloudFront can now forward two new optional headers to an origin, AWS announced on 30 October. CloudFront-Viewer-ISP carries the name of the viewer's internet service provider, so the origin can see which network a request came from. CloudFront-Viewer-TLS-Details describes the cryptography of each viewer's TLS connection: the key exchange, the signature scheme and the signature public key type.
AWS frames the first header as a tool for breaking traffic and performance down by network and for isolating unusual traffic from a single provider. The second is aimed at post-quantum migration: it lets an operator measure what share of viewers actually connect with post-quantum cryptography and identify the clients that do not yet do so.
Neither header is sent by default. To forward one, it has to be added to an origin request policy, and the policy attached to the distribution.
What it means
Post-quantum key exchange at the edge has mostly been something a CDN switches on and reports in aggregate, if at all. A per-request header puts the data where the application can use it: in origin logs, next to user agent and route, so a team can see which clients and which parts of its traffic are still on classical key exchange before it decides anything about older algorithms. One practical note: adding headers to an origin request policy changes what reaches the origin on every request, so it is worth checking whether that policy is also wired into the cache key before rolling it out.