Are HTTP Headers configured by the CDN or by the application?

SpiceTortilla

11/28/23, 8:58 AM

This is kind of a theoretical question, and I guess it may be too broad or unclear.

Foobar is an application serving users across the internet. It relies on a CDN to improve its resiliency, speed, etc to serve people wherever they are.

Are the HTTP headers (received by the client) defined by the CDN, or by the Foobar application (implying the CDN will forward them)?
If both are possible, what are the pros and cons of either?

307

1 + 1

cdn

http-headers

user253751

11/28/23, 7:57 PM

depends on your CDN

Score:2

Server

diya

11/28/23, 11:18 AM

There is no universal answer. What gets done with/to headers depends both on the request, the specific CDN, the specific header and your site configuration (that includes both the headers your backend/origin server includes in the response and how you configure your site in the CDN).

Assume that by default the majority of headers will be stripped from the response generated by a back-end/origin server and only a (minimal) subset of headers will be set in the response sent by the CDN.

Some (CDN specific) headers might be added by the CDN according to your policies or by default. For example Fastly adds a x-served-by: header by default and CloudFront allows you to set and optional Server-Timing: header to facilitate debugging CDN operations.

Some headers might be preserved from your back-end server. For example Cache-control: and Expires: headers are fairly common ones. See for example: Cloud Front docs

Some might be adjusted by the CDN in specific ways. For example see how Fastly deals with a Date: header set in the origin.

Reasons to set headers at the CDN

Rather than allowing each application to do their own thing, or not do anything you set a single policy for all your sites and applications at the CDN level.

Good examples are CORS and HSTS policies.

You may choose to only set/add a specific header at the CDN when the origin does not, but use the value from the origin if it is set there.

etc. etc.

Reasons to preserve headers set at the origin

The application (developer) knows best what the application needs.

Overriding the default caching policy with a Cache-Control: private, no-store is a text book example that comes to mind.

etc. etc.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Are HTTP Headers configured by the CDN or by the application?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.