Thanks for your answer.
The second solution requires a previous request to know the IP or browser language values to pass to the function.
The first solution is obvious but the purpose was to use a callable to avoid validating auth tokens and deserializing the request body by myself.
It's a shame to have headers completely hidden from the HTTPS Callable API. Information is there, we could avoid boilerplate code and prevent useless requests but no, we can't access it :(
Kind Regards,
Laurent Pellegrino