In short. CloudFront removes the header first, then adds it from another policy section, so the same header appears in the viewer response.
Definition: A CloudFront response headers policy removes headers before it adds headers from other sections of the same policy. If a header appears in Remove headers and in another section, CloudFront includes that header in the response sent to the viewer.
Key facts
- Amazon CloudFront's response headers policy reference says a policy specifies HTTP headers that CloudFront removes or adds in responses sent to viewers.
- The Remove headers setting applies to every response sent to viewers, including responses for objects served from CloudFront cache and responses from the origin.
- CloudFront removes selected headers first, then adds headers specified in the CORS, security, custom header and other sections of the policy.
- When the same header is named for removal and addition, CloudFront includes that header in the viewer response.
- The documentation gives
X-Powered-ByandVaryas examples of headers that a policy can remove.
How does the processing order work?
The Remove headers section acts before the other header sections. This order means that removal is an intermediate processing step, not the final state of the response. A later policy section can add a header with the same name after the earlier removal.
For example, a policy can identify the same name in its removal and custom header settings:
Remove headers: X-Powered-By
Custom headers: X-Powered-By
This illustration follows the AWS documentation's X-Powered-By removal example and its description of custom headers as headers that CloudFront adds to responses returned to viewers. The documented result is that X-Powered-By is present in the viewer response because the policy adds it after removing it.
Which response does the policy affect?
CloudFront applies the removal to every response it sends to viewers, whether the object comes from CloudFront cache or from the origin. The ordering therefore describes the response processing performed for the viewer response, including a cached response.
The policy reference describes custom headers as headers CloudFront adds to every response it returns to viewers. A custom header can have an optional value, so the policy can add a header without a value. Each custom header also has an Origin override setting. When that setting is true and the origin response contains the same custom header, CloudFront adds the policy header and ignores the origin header. When it is false, CloudFront includes the header received from the origin.
Are Server and Date handled the same way?
The reference documents a special result for Server and Date. A response headers policy can remove the versions of those headers received from the origin. CloudFront then adds its own versions to the response sent to viewers. For the Server header that CloudFront adds, the value is CloudFront.
This special case does not change the general ordering rule. It shows that removing an origin header does not necessarily mean that the final viewer response lacks that header when CloudFront supplies its own version.
Related terms
- Which value wins when CloudFront and the origin set the same custom response header?
- Does adding Cache-Control through a CloudFront response policy change edge caching?
- How can CloudFront apply a robots header only to a selected URL path?
FAQ
Does the Remove headers setting win when the same header is added elsewhere in the policy?
No. AWS documents that CloudFront removes headers first and then adds headers from other policy sections. The same header is included in the response sent to the viewer.
Can removing an origin header remove the final header from the viewer response?
Not in every case. For Server and Date, CloudFront documents that it adds its own versions after removing the versions received from the origin. The Server value that CloudFront adds is CloudFront.
Sources
Check how a page reads to answer engines. Open the GEO score analyzer