Headers

The [headers] section configures global request and response header manipulation. Dynamic. It is distinct from:

• Per-domain header rules under [domains.headers] (same shape; applied after global headers)
• Per-route header rules under [domains.routes.headers] (same shape; applied after domain headers)
• [security.headers]: HSTS, CSP, and custom security response headers: whole-block replace semantics (see Security)
• Forwarding: X-Forwarded-* set by the proxy (see Security)

The [headers] cascade is additive: global → domain → route accumulate in order; for a given header name the most specific scope wins. This is different from security.headers, which is replaced wholesale.

Structure

• [headers.request]: add / remove lists
• [headers.response]: add / remove lists

The same shape applies at [domains.headers] and [domains.routes.headers].

Example

YAML

headers:
 request:
 remove:
 - "X-Forwarded-Server"
 add:
 - name: "X-Proxy-Name"
 value: "huginn-proxy"
 response:
 remove:
 - "Server"
 - "X-Powered-By"
 add:
 - name: "X-Proxy"
 value: "huginn-proxy"

TOML

[headers.request]
remove = ["X-Forwarded-Server"]
add = [
 { name = "X-Proxy-Name", value = "huginn-proxy" },
]

[headers.response]
remove = ["Server", "X-Powered-By"]
add = [
 { name = "X-Proxy", value = "huginn-proxy" },
]

See examples/config/compose.toml and compose.yaml on GitHub for complete examples.

Related

• Configuration overview