Cloudflare-Google_Custom_Headers-new.txt

# Massive Collection of either 
# *.Cloudflare[.com|.dev] 
# and/or
# *.Google.com Request/Response headers

Note: Apologies for not having much in terms of specifics of what these headers do, if they are request or response, if they actaully 
      interact and work on CF or Google, but I found this kick ass collection on a cloudflare.dev site in a obfuscasted JS array.
      This would have been called custom CF headers however there is so much reference to Google. Experiment. ;)

Unknown Prefix: [I didnt cut or strip the prefixs on these it may likely be irrelevant but you figure it out]:
Ih={cha:"Authorization"
D1:"Content-ID"
Aha:"Content-Transfer-Encoding"
Bha:"Content-Type"
gia:"Date"
Yka:"OriginToken"
vja:"hotrod-board-name"
wja:"hotrod-chrome-cpu-model"
xja:"hotrod-chrome-processors"
Kna:"WWW-Authenticate"
Mna:"X-Ad-Manager-Impersonation"
Lna:"X-Ad-Manager-Debug-Info"
Nna:"X-ClientDetails"
Ona:"X-Compass-Routing-Destination"
Rna:"X-Goog-AuthUser"
Una:"X-Goog-Encode-Response-If-Executable"
Pna:"X-Google-Consent"
Qna:"X-Google-EOM"
Wna:"X-Goog-Meeting-ABR"
Xna:"X-Goog-Meeting-Botguardid"

Yna:"X-Goog-Meeting-ClientInfo"
Zna:"X-Goog-Meeting-ClientVersion"
aoa:"X-Goog-Meeting-Debugid"
boa:"X-Goog-Meeting-Identifier"
coa:"X-Goog-Meeting-Interop-Cohorts"
doa:"X-Goog-Meeting-Interop-Type"
eoa:"X-Goog-Meeting-OidcIdToken"
foa:"X-Goog-Meeting-RtcClient"
goa:"X-Goog-Meeting-StartSource"
hoa:"X-Goog-Meeting-Token"
ioa:"X-Goog-Meeting-Viewer-Token"
joa:"X-Goog-PageId"
koa:"X-Goog-Safety-Content-Type"
loa:"X-Goog-Safety-Encoding"
Sna:"X-Goog-Drive-Client-Version"
Tna:"X-Goog-Drive-Resource-Keys"
moa:"X-HTTP-Method-Override"
noa:"X-JavaScript-User-Agent"
ooa:"X-Origin"
poa:"X-Referer"
qoa:"X-Requested-With"
toa:"X-Use-HTTP-Status-Code-Override"
roa:"X-Server-Timeout"
Vna:"X-Goog-First-Party-Reauth"
soa:"X-Server-Token"
                                                   ---------------======================-----------------
Accept
Accept-Language
Authorization
Cache-Control
cast-device-capabilities
Content-Disposition
Content-Encoding
Content-Language
Content-Length
Content-MD5
Content-Range
Content-Transfer-Encoding
Content-Type
Date
developer-token
EES-S7E-MODE
financial-institution-id
GData-Version
google-cloud-resource-prefix
hotrod-board-name
hotrod-chrome-cpu-model
hotrod-chrome-processors
Host
If-Match
If-Modified-Since
If-None-Match
If-Unmodified-Since
linked-customer-id
login-customer-id
MIME-Version
Origin
OriginToken
Pragma
Range
request-id
Slug
Transfer-Encoding
Want-Digest
X-Ad-Manager-Impersonation
X-Ad-Manager-Debug-Info
x-alkali-account-key
x-alkali-application-key
x-alkali-auth-apps-namespace
x-alkali-auth-entities-namespace
x-alkali-auth-entity
x-alkali-client-locale
x-chrome-connected
x-framework-xsrf-token
X-Client-Data
X-ClientDetails
X-Client-Version
x-debug-settings-metadata
X-Firebase-Locale
X-GData-Client
X-GData-Key
X-Goog-AuthUser
X-Goog-PageId
X-Goog-Encode-Response-If-Executable
X-GoogApps-Allowed-Domains
X-Goog-AdX-Buyer-Impersonation
X-Goog-Api-Client
X-Goog-Api-Key
X-Google-EOM
X-Goog-Visibilities
X-Goog-Correlation-Id
X-Goog-Request-Info
X-Goog-Request-Reason
X-Goog-Request-Time
X-Goog-Experiments
x-goog-ext-124712974-jspb
x-goog-ext-251363160-jspb
x-goog-ext-259736195-jspb
x-goog-ext-467253834-jspb
x-goog-ext-472780938-jspb
x-goog-ext-477772811-jspb
x-goog-ext-275505673-bin
x-goog-ext-353267353-bin
x-goog-ext-353267353-jspb
x-goog-ext-496773601-bin
x-goog-ext-328800237-bin
x-goog-ext-359275022-bin
x-goog-ext-202735639-bin
x-goog-ext-223435598-bin
x-goog-ext-174067345-bin
x-goog-ext-525001598-jspb
X-Goog-Firebase-Installations-Auth
x-goog-greenenergyuserappservice-metadata
X-Firebase-Client
X-Firebase-Client-Log-Type
X-Firebase-GMPID
X-Firebase-Auth-Token
X-Firebase-AppCheck
X-Firebase-Token
X-Goog-Drive-Client-Version
X-Goog-Drive-Resource-Keys
x-goog-iam-authority-selector
x-goog-iam-authorization-token
x-goog-request-params
x-goog-sherlog-context
X-Goog-Sn-Metadata
X-Goog-Sn-PatientId
X-Goog-Spatula
X-Goog-Travel-Bgr
X-Goog-Travel-Settings
X-Goog-Upload-Command
X-Goog-Upload-Content-Disposition
X-Goog-Upload-Content-Length
X-Goog-Upload-Content-Type
X-Goog-Upload-File-Name
X-Goog-Upload-Header-Content-Encoding
X-Goog-Upload-Header-Content-Length
X-Goog-Upload-Header-Content-Type
X-Goog-Upload-Header-Transfer-Encoding
X-Goog-Upload-Offset
X-Goog-Upload-Protocol
X-Goog-User-Project
X-Goog-Visitor-Id
X-Goog-FieldMask
X-Google-Project-Override
x-goog-maps-api-salt
x-goog-maps-api-signature
x-goog-maps-client-id
x-goog-maps-channel-id
x-goog-spanner-database-role
X-HTTP-Method-Override
X-JavaScript-User-Agent
X-Pan-Versionid
X-Proxied-User-IP
X-Origin
X-Referer
X-Requested-With
X-Stadia-Client-Context
X-Upload-Content-Length
X-Upload-Content-Type
X-Use-Alt-Service
X-Use-HTTP-Status-Code-Override
X-Ios-Bundle-Identifier
X-Android-Package
X-Android-Cert
X-Ariane-Xsrf-Token
X-Earth-Engine-App-ID-Token
X-Earth-Engine-Computation-Profile
X-Earth-Engine-Computation-Profiling
X-Play-Console-Experiments-Override
X-Play-Console-Session-Id
X-YouTube-Bootstrap-Logged-In
X-YouTube-VVT
X-YouTube-Page-CL
X-YouTube-Page-Timestamp
X-Compass-Routing-Destination
X-Goog-Meeting-ABR
X-Goog-Meeting-Botguardid
X-Goog-Meeting-ClientInfo
X-Goog-Meeting-ClientVersion
X-Goog-Meeting-Debugid
X-Goog-Meeting-Identifier
X-Goog-Meeting-Interop-Cohorts
X-Goog-Meeting-Interop-Type
X-Goog-Meeting-OidcIdToken
X-Goog-Meeting-RtcClient
X-Goog-Meeting-StartSource
X-Goog-Meeting-Token
X-Goog-Meeting-Viewer-Token
x-sdm-id-token
X-Sfdc-Authorization
X-Server-Timeout
x-foyer-client-environment
X-Goog-First-Party-Reauth
X-Server-Token
x-rfui-request-context

Also note, I *do* believe the headers are case sensitive, I do not believe the values are, please verify, the following were found in the same js file
on CF dev server, they may look and likely are mixed in with generic headers, but I see a ton of custom ones that may help you control or misdirect/redirect
the requests to get backend info:

Header List:
------------
Digest
Cache-Control
Content-Disposition
Content-Encoding
Content-Language
Content-Length
Content-MD5
Content-Range
Content-Transfer-Encoding
Content-Type
Date
ETag
Expires
Last-Modified
Location
Pragma
Range
Server
Transfer-Encoding
WWW-Authenticate
Vary
Unzipped-Content-MD5
X-Correlation-ID
X-Debug-Tracking-Id
X-Google-Consent
X-Google-EOM
X-Goog-Generation
X-Goog-Metageneration
X-Goog-Safety-Content-Type
X-Goog-Safety-Encoding
X-Google-Trace
X-Goog-Upload-Chunk-Granularity
X-Goog-Upload-Control-URL
X-Goog-Upload-Size-Received
X-Goog-Upload-Status
X-Goog-Upload-URL
X-Goog-Diff-Download-Range
X-Goog-Hash
X-Goog-Updated-Authorization
X-Server-Object-Version
X-Guploader-Customer
X-Guploader-Upload-Result
X-Guploader-Uploadid
X-Google-Gfe-Backend-Request-Cost
X-Earth-Engine-Computation-Profile
X-Goog-Meeting-ABR
X-Goog-Meeting-Botguardid
X-Goog-Meeting-ClientInfo
X-Goog-Meeting-ClientVersion
X-Goog-Meeting-Debugid
X-Goog-Meeting-RtcClient
X-Goog-Meeting-Token
X-Goog-Meeting-Viewer-Token
X-Compass-Routing-Destination


Courtesy of substance
[EOF]