Headers Middleware

Managing Request/Response Headers The Headers middleware manages the headers of requests and responses. A set of forwarded headers are automatically added by default.

Configuration Examples

Adding Headers to Request and Response

labels:
  - "traefik.http.middlewares.testHeader.headers.customrequestheaders.X-Script-Name=test"
  - "traefik.http.middlewares.testHeader.headers.customresponseheaders.X-Custom-Response-Header=value"

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: test-header
spec:
  headers:
    customRequestHeaders:
      X-Script-Name: "test"
    customResponseHeaders:
      X-Custom-Response-Header: "value"

http:
  middlewares:
    testHeader:
      headers:
        customRequestHeaders:
          X-Script-Name: "test"
        customResponseHeaders:
          X-Custom-Response-Header: "value"

[http.middlewares]
  [http.middlewares.testHeader.headers]
    [http.middlewares.testHeader.headers.customRequestHeaders]
      X-Script-Name = "test"
    [http.middlewares.testHeader.headers.customResponseHeaders]
      X-Custom-Response-Header = "value"

Security Headers

labels:
  - "traefik.http.middlewares.testHeader.headers.framedeny=true"
  - "traefik.http.middlewares.testHeader.headers.browserxssfilter=true"
  - "traefik.http.middlewares.testHeader.headers.stsSeconds=31536000"

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: test-header
spec:
  headers:
    frameDeny: true
    browserXssFilter: true
    stsSeconds: 31536000

http:
  middlewares:
    testHeader:
      headers:
        frameDeny: true
        browserXssFilter: true
        stsSeconds: 31536000

[http.middlewares]
  [http.middlewares.testHeader.headers]
    frameDeny = true
    browserXssFilter = true
    stsSeconds = 31536000

CORS Headers

labels:
  - "traefik.http.middlewares.testheader.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
  - "traefik.http.middlewares.testheader.headers.accesscontrolallowheaders=*"
  - "traefik.http.middlewares.testheader.headers.accesscontrolalloworiginlist=https://foo.bar.org,https://example.org"
  - "traefik.http.middlewares.testheader.headers.accesscontrolmaxage=100"
  - "traefik.http.middlewares.testheader.headers.addvaryheader=true"

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: test-header
spec:
  headers:
    accessControlAllowMethods:
      - "GET"
      - "OPTIONS"
      - "PUT"
    accessControlAllowHeaders:
      - "*"
    accessControlAllowOriginList:
      - "https://foo.bar.org"
      - "https://example.org"
    accessControlMaxAge: 100
    addVaryHeader: true

http:
  middlewares:
    testHeader:
      headers:
        accessControlAllowMethods:
          - GET
          - OPTIONS
          - PUT
        accessControlAllowHeaders: "*"
        accessControlAllowOriginList:
          - https://foo.bar.org
          - https://example.org
        accessControlMaxAge: 100
        addVaryHeader: true

[http.middlewares]
  [http.middlewares.testHeader.headers]
    accessControlAllowMethods = ["GET", "OPTIONS", "PUT"]
    accessControlAllowHeaders = ["*"]
    accessControlAllowOriginList = ["https://foo.bar.org","https://example.org"]
    accessControlMaxAge = 100
    addVaryHeader = true

Configuration Options

Custom headers will overwrite existing headers if they have identical names.

Custom Headers

object

Header names and values to apply to the request.

object

Header names and values to apply to the response.

CORS Headers

boolean

Indicates whether the request can include user credentials.

array

Header field names that can be used as part of the request.

array

Methods that can be used during requests.

array

List of allowed origins. A wildcard origin * can also be configured.

array

Regular expressions for allowed origins.

array

Headers that are safe to expose to the API of a CORS API specification.

integer

How many seconds a preflight request can be cached.

boolean

Add or modify the Vary header to demonstrate that server responses can differ based on the origin header.

Security Headers

integer

default:"0"

Max-age of the Strict-Transport-Security header. If set to 0, the header is not set.

boolean

Add includeSubDomains directive to Strict-Transport-Security header.

boolean

Add preload flag to Strict-Transport-Security header.

boolean

Add STS header even when the connection is HTTP.

boolean

Add X-Frame-Options header with the value of DENY.

string

Set custom value for X-Frame-Options header (overrides frameDeny).

boolean

Add X-Content-Type-Options header with the value nosniff.

boolean

Add X-XSS-Protection header with the value 1; mode=block.

string

Set Content-Security-Policy header value.

string

Control whether browsers forward the Referer header to other sites.

string

Control browser features.

Getting Started

Core Configuration

Providers

Routing

Middlewares

HTTPS & TLS

Observability

Operations

Headers Middleware

Headers Middleware

Configuration Examples

Adding Headers to Request and Response

Security Headers

CORS Headers

Configuration Options

Custom Headers

CORS Headers

Security Headers

​Headers Middleware

​Configuration Examples

​Adding Headers to Request and Response

​Security Headers

​CORS Headers

​Configuration Options

​Custom Headers

​CORS Headers

​Security Headers

Headers Middleware

Configuration Examples

Adding Headers to Request and Response

Security Headers

CORS Headers

Configuration Options

Custom Headers

CORS Headers

Security Headers