What Changed?
With the migration from Akamai to Cloudflare for the CDN, HTTP headers are now normalized to lowercase per the HTTP/2 standard (RFC 7540).
- Previous (Akamai): Headers preserved their original casing (e.g., Content-Type)
- Current (Cloudflare): All headers are lowercase (e.g., content-type) to ensure uniformity for search, storage, and natural language processing.
Why?
Cloudflare strictly enforces HTTP/2 standards, which require lowercase headers. This aligns with RFC 7230, which states header names should always be treated as case-insensitive.
Who's Affected?
Customers with custom Apex code that use case-sensitive header name matching are affected by the change.
Update your applicable code to treat header names as case-insensitive to avoid breaking the code.
// ❌ BEFORE - Case-Sensitive (Will Break)
RestRequest req = RestContext.request;
String contentType = req.headers.get('Content-Type'); // Returns null with HTTP/2
String authToken = req.headers.get('Authorization'); // Returns null with HTTP/2
// ✅ AFTER - Case-Insensitive (Works Correctly)
RestRequest req = RestContext.request;
String contentType = req.headers.get('content-type'); // Works with HTTP/2
String authToken = req.headers.get('authorization'); // Works with HTTP/2
Note: Since Salesforce instances are being migrated from Akamai to Cloudflare at different times, to ensure compatibility both before and after the migration, the safer approach would be:
String contentType = String.isBlank(req.headers.get('content-type'))?req.headers.get('Content-Type'):req.headers.get('content-type');
Once your instance has been migrated, you can simplify to:
String contentType = req.headers.get('content-type');
005318663

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.