Headers and cookies

Choose the scope for response metadata changes: host-wide transformations affect the load balancer, while route-specific headers affect only matching paths. Both can preserve the application body.

Host-wide headers and cookies

Visitor response: x-showcase: custom-responses and a showcase=custom-responses cookie, without x-origin-remove or origin-remove.

Configure the add and remove lists under the load balancer’s more_option field. The added header uses append: false. The cookie has path /, Secure, HttpOnly, SameSite Lax, and overwrite: true. Check name collisions before overwriting origin values. Adding a cookie here does not sign a user in.

Response transformations source

{
  "spec": {
    "more_option": {
      "response_headers_to_add": [
        {
          "name": "x-showcase",
          "value": "custom-responses",
          "append": false
        }
      ],
      "response_headers_to_remove": [
        "x-origin-remove"
      ],
      "response_cookies_to_add": [
        {
          "name": "showcase",
          "value": "custom-responses",
          "add_path": "/",
          "add_secure": {},
          "add_httponly": {},
          "samesite_lax": {},
          "overwrite": true
        }
      ],
      "response_cookies_to_remove": [
        "origin-remove"
      ]
    }
  }
}

Expected result: The transformed host returns the added header and cookie, omits the unwanted values, and preserves the application body. Compare with the untransformed shared error host because these settings apply to the load balancer, not just one path.

Verified live example: Open the transformed response and inspect its response headers and cookies.

Route-specific headers

For metadata confined to one path, /demo/headers adds X-CR-Route: scoped under the route’s advanced_options. The root response omits this header. The existing host-wide transformations still apply to both responses.

{
  "spec": {
    "routes": [
      {
        "simple_route": {
          "path": {
            "path": "/demo/headers"
          },
          "http_method": "ANY",
          "origin_pools": [
            {
              "pool": {
                "name": "<ORIGIN_POOL_NAME>",
                "namespace": "<XC_NAMESPACE>"
              },
              "weight": 1,
              "priority": 1
            }
          ],
          "advanced_options": {
            "priority": "DEFAULT",
            "response_headers_to_add": [
              {
                "name": "X-CR-Route",
                "value": "scoped",
                "append": false
              }
            ]
          }
        }
      }
    ]
  }
}

Expected result: Compare /demo/headers with / on the same host. Only the selected route has X-CR-Route; both responses keep the synthetic origin body. Use Compare scoped headers in the application demo panel to compare them. It sends two fixed requests only when clicked.

Verified live example: Open the scoped-header route.

The different controls reflect scope: use an untransformed host for host-wide settings and a nonmatching path on the same host for route settings. See CORS for browser permission to read a cross-origin response.