Which response headers cannot be modified by Azure Front Door rules?

Definition: Azure Front Door rule set actions cannot modify a documented list of reserved HTTP headers, or any header whose name starts with x-ec or x-fd. The restriction covers both the modify request header and modify response header actions.

Key facts

• Microsoft's Azure Front Door rule set actions reference applies the reserved-header restriction to actions that modify request headers and response headers.
• The reserved names include Host, Connection, Content-Length, Transfer-Encoding, TE, Upgrade, Range, Forwarded, and Via.
• The list also includes Azure and Front Door fields such as X-Ms-Via, X-Ms-Force-Refresh, X-MSEdge-Ref, X-Azure-FDID, and X-Azure-Ref.
• The two reserved prefixes documented by Microsoft are x-ec and x-fd.
• RFC 9110 states that HTTP field names are case-insensitive, so spelling case is not a separate HTTP field name.

Which names and prefixes are reserved?

The Azure Front Door reference states that reserved headers cannot be modified with rules engine actions. It names both request and response header actions, then lists the following names and prefixes:

Accept-Ranges
Host
Connection
Content-Length
Transfer-Encoding
TE
Last-Modified
Keep-Alive
Expect
Upgrade
If-Modified-Since
If-Unmodified-Since
If-None-Match
If-Match
Range
If-Range
X-Ms-Via
X-Ms-Force-Refresh
X-MSEdge-Ref
Warning
Forwarded
Via
X-Forwarded-For
X-Forwarded-Proto
X-Forwarded-Host
X-Azure-RequestChain
X-Azure-FDID
X-Azure-RequestChainv2
X-Azure-Ref
x-ec*
x-fd*

The asterisk in the final two lines represents a name prefix. The page writes the prefixes in lowercase. RFC 9110's field-name definition says that field names are case-insensitive and should be registered in the HTTP Field Name Registry.

What do the response-header operators do?

The Microsoft reference defines the modify response header action as changing headers present in responses before those responses are returned to clients. It supports three operators. Append adds the specified value, and when the header already exists it concatenates the value without adding a delimiter. Overwrite replaces the existing value when the header is already present. Delete removes a present header.

These operators describe the action applied to an eligible header. They do not create an exception for a reserved name. For example, the documented Delete behavior cannot remove Host, Content-Length, or X-Azure-FDID through a rule set action because those names are in the reserved list.

RFC 9110 explains why some listed names are protocol-sensitive. Host carries the target authority used for request handling. Connection lists control options for the current connection, and intermediaries process it before forwarding a message. Content-Length indicates the associated representation's data length and can delimit message content. Range and the conditional fields such as If-Match and If-Modified-Since participate in request conditions and partial transfers.

How should a rule be checked?

The rule set action reference shows ModifyResponseHeader with a headerAction and headerName property. A configuration can therefore be inspected by finding the header name supplied to that action and comparing it with the reserved list and prefixes:

{
  "name": "ModifyResponseHeader",
  "parameters": {
    "headerAction": "Delete",
    "headerName": "X-Powered-By",
    "typeName": "DeliveryRuleHeaderActionParameters"
  }
}

The example uses X-Powered-By, which is outside the documented reserved list. A name matching a listed field or the x-ec or x-fd prefix is in the restricted set for the request and response header actions.

Related terms

• Does Azure Front Door insert a separator when appending a response header?
• How can Azure Front Door ignore selected tracking parameters in its cache key?
• How can Azure Front Door preserve the rest of a path during a rewrite?
• Why can an Azure Front Door origin override disable caching?

FAQ

Can you delete a reserved response header with a Delete action?

No. The Microsoft reference includes the Delete operator in the response-header action, while its reserved-header note excludes the listed names and the two prefixes from modification.

Does Append add a separator between header values?

No. Azure Front Door documents Append as string concatenation and states that no delimiters are added when a header already has a value.

Sources

1. Microsoft, "Rule set actions - Azure Front Door", 19 July 2024
2. Internet Engineering Task Force, "HTTP Semantics", June 2022

---

Check how a page reads to answer engines. Open the GEO score analyzer