600 Invalid Headers
The HTTP 600 Invalid Headers status code is an unofficial response code defined by Akamai. The 600 range (6xx) appears in Akamai reporting dashboards and log data to classify responses involving malformed or non-compliant HTTP headers.
Usage
Akamai edge servers inspect HTTP headers for compliance with HTTP semantics. When a request or response contains headers with invalid characters, improper formatting, or structural violations, Akamai classifies the transaction under the 6xx response class in its reporting infrastructure.
The 600 code does not travel over the wire as a standard HTTP response to clients. Instead, Akamai uses the 6xx range internally for traffic analytics, DataStream log entries, and the Reporting API. Clients receiving the actual HTTP response see a 400 Bad Request when strict header parsing is enabled on the Akamai property configuration.
Note
The 600 range is an Akamai-specific reporting classification. Standard HTTP status codes end at 599. The 6xx range exists only in Akamai logs and dashboards.
Strict Header Parsing in Akamai Property Manager controls the behavior:
- Valid Mode rejects requests with header names containing characters outside the allowed set.
- Strict Mode enforces additional checks on header value formatting and structure.
When neither mode is enabled, Akamai edge servers still log a warning for non-compliant headers but forward the request to the origin. The transaction appears as a 6xx entry in reporting data regardless of whether the request was blocked or passed through.
Common header violations triggering 6xx classification include:
- Header names containing spaces, control characters, or non-ASCII bytes.
- Header values with bare carriage returns or line feeds (potential HTTP response splitting vectors).
- Duplicate or conflicting Content-Length values.
- Excessively large headers exceeding buffer limits.
Example
An Akamai Reporting API response showing traffic breakdown by response class. The 6xx entry represents requests flagged for invalid headers.
{
"response_class": "6xx",
"description": "Invalid headers (defined by Akamai)",
"edge_hits": 1247,
"percentage": 0.03
}
A DataStream 2 log entry for a request rejected by strict header parsing. The client received a 400 Bad Request, but Akamai classified the transaction as 6xx in its logs.
{
"statusCode": 400,
"akamaiResponseClass": "6xx",
"requestHeaders": "X-Custom\x00Header: value",
"strictHeaderParsingAction": "reject"
}
How to fix
Enable Strict Header Parsing in Akamai Property Manager to block requests with invalid headers before they reach the origin. Navigate to the property configuration, add the Strict Header Parsing behavior, and enable both Valid Mode and Strict Mode for full HTTP specification compliance.
Audit origin server responses for non-compliant headers. Headers generated by the origin containing invalid characters appear as 6xx entries in Akamai reporting. Common offenders include debug headers with unescaped special characters, middleware injecting binary data into header values, and applications producing duplicate Content-Length headers.
Monitor the Akamai Reporting dashboard for 6xx
traffic trends. A spike in 6xx entries after a
deployment indicates the new code is generating
invalid headers. Filter DataStream 2 logs by
akamaiResponseClass=6xx to identify the specific
headers and origin endpoints involved.
Sanitize client-generated headers in frontend code.
Custom headers added by JavaScript
(fetch or XMLHttpRequest) containing
non-ASCII characters or control characters trigger
6xx classification at the Akamai edge.
Takeaway
The 600 Invalid Headers classification is an Akamai-specific reporting designation for HTTP transactions involving non-compliant headers. The 6xx range exists only in Akamai logs and analytics. Clients see a 400 Bad Request when strict header parsing rejects the request.