600 Invalid Headers
The 600 Invalid Headers classification is an Akamai-specific reporting designation for HTTP transactions involving malformed or non-compliant headers. The 6xx range appears only in Akamai dashboards and log data.
Usage
Akamai edge servers inspect HTTP headers for compliance with HTTP semantics. When a request or response contains headers with invalid characters, improper formatting, or structural violations, Akamai classifies the transaction under the 6xx response class in its reporting infrastructure.
The 600 code does not travel over the wire as a standard HTTP response to clients. Instead, Akamai uses the 6xx range internally for traffic analytics, DataStream log entries, and the Reporting API. Clients receiving the actual HTTP response see a 400 Bad Request when strict header parsing is enabled on the Akamai property configuration.
Note
The 600 range is an Akamai-specific reporting classification. Standard HTTP status codes end at 599. The 6xx range exists only in Akamai logs and dashboards.
Strict Header Parsing in Akamai Property Manager controls the behavior:
- Valid Mode rejects requests containing invalid characters in header names or values.
- Strict Mode rejects requests with malformed header line structure, such as a leading colon, a missing colon, or a missing CRLF terminator.
When Strict Mode is disabled, Akamai edge servers correct the malformed header line, removing or rewriting it, before forwarding the request to the origin. The transaction appears as a 6xx entry in reporting data regardless of whether the request was blocked or passed through.
Common header violations triggering 6xx classification include:
- Header names containing spaces, control characters, or non-ASCII bytes.
- Header values with bare carriage returns or line feeds (potential HTTP response splitting vectors).
- Malformed header lines with a leading colon, a missing colon, or a missing CRLF terminator.
Example
An Akamai Reporting API response showing traffic breakdown by response class. The 6xx entry represents requests flagged for invalid headers.
{
"response_class": "6xx",
"description": "Invalid headers (defined by Akamai)",
"edge_hits": 1247,
"percentage": 0.03
}
A DataStream 2 log entry for a request rejected by strict header parsing records the client-visible status. The client received a 400 Bad Request, while the 6xx classification appears in Akamai's reporting dimensions rather than in DataStream log fields. A simplified log entry:
{
"statusCode": 400,
"reqMethod": "GET",
"reqPath": "/api/data"
}
How to fix
Enable Strict Header Parsing in Akamai Property Manager to block requests with invalid headers before they reach the origin. Navigate to the property configuration, add the Strict Header Parsing behavior, and enable both Valid Mode and Strict Mode for full HTTP specification compliance.
Audit origin server responses for non-compliant headers. Headers generated by the origin containing invalid characters appear as 6xx entries in Akamai reporting. Common offenders include debug headers with unescaped special characters and middleware injecting binary data into header values.
Monitor the Akamai Reporting dashboard for 6xx traffic trends. A spike in 6xx entries after a deployment indicates the new code is generating invalid headers. Cross-reference the affected time window with DataStream 2 logs, filtering on status code and request path, to identify the specific headers and origin endpoints involved.
Sanitize client-generated headers in frontend code.
Custom headers added by JavaScript
(fetch or XMLHttpRequest) containing
non-ASCII characters or control characters trigger
6xx classification at the Akamai edge.
