Headers

Overview

coreX Platform manages HTTP headers in two places:

Response Headers — modify headers on the response before it’s sent to the client. Scoped per listener.
Request Headers — modify headers on the request before it’s forwarded to the backend. Scoped per backend.

Both support the same three actions (override, add, del) and an optional HAProxy ACL condition that gates whether the rule fires.

Response Headers

Response header rules modify headers on the response before it’s sent to the client. They are scoped per listener (one or many, or all listeners when none are selected).

Property	Description
Header	Header name (e.g. `Strict-Transport-Security`)
Value	Header value (e.g. `max-age=31536000`)
Action	`override`, `add`, or `del` (see below)
Listeners	Selected listeners, or all when none selected
Condition	Optional HAProxy ACL — the rule only fires when the condition matches

Action	Description
override	Set the header, overwriting any existing value (HAProxy `http-response set-header`)
add	Append the header without overwriting an existing value (HAProxy `http-response add-header`)
del	Remove the header from the response (HAProxy `http-response del-header`)

CSP header conflicts with Page Protect

If you set a Content-Security-Policy response header manually and also use Page Protect, the Page Protect CSP (emitted in the backend section) takes precedence because HAProxy set-header is last-writer-wins and the backend section runs after the frontend response-header rules. Manage CSP through Page Protect instead of response header rules to avoid surprises.

Request Headers

Request header rules modify headers on the request before it’s forwarded to the backend. They are scoped per backend (one or many, or all backends when none are selected).

Property	Description
Header	Header name (e.g. `X-Forwarded-For`)
Value	Header value (e.g. `%ci`)
Action	`override`, `add`, or `del` (see below)
Backends	Selected backends, or all when none selected
Condition	Optional HAProxy ACL — the rule only fires when the condition matches

Action	Description
override	Set the header, overwriting any existing value (HAProxy `http-request set-header`)
add	Append the header without overwriting an existing value (HAProxy `http-request add-header`)
del	Remove the header from the request (HAProxy `http-request del-header`)

When to use request headers

Common uses: inject X-Forwarded-Proto so the backend knows the original scheme, add X-Request-ID for tracing, strip hop-by-hop headers like Connection, or inject a fixed auth header for legacy backends that don’t read the TLS client certificate.

Step-by-Step: Add a Response Header

Navigate to Traffic > Headers > Response Headers
Click Add Header
Header: X-Content-Type-Options
Value: nosniff
Action: override
Listeners: all (or select specific listeners)
Save and Apply

Step-by-Step: Add a Request Header

Navigate to Traffic > Headers > Request Headers
Click Add Header
Header: X-Forwarded-Proto
Value: https
Action: override
Backends: select the backend(s) that should receive the header (or all)
Save and Apply

Verification

Test response headers:

curl -k -sI https://localhost/ | grep -i x-content-type

Test request headers:
- Configure a backend that echoes request headers (e.g. httpbin.org/headers)
- Send a request and verify the injected header appears in the echoed headers:
```
curl -k https://localhost/headers | python3 -m json.tool
```

Next Steps

Redirects & Rewrites — URL redirects, rewrites, and custom error pages
Page Protect — Manage CSP and other security headers
Listeners & Backends — Configure listeners and backends