Which value wins when CloudFront and the origin set the same custom response header?

Definition: When a custom response header exists in both an Amazon CloudFront response headers policy and the origin response, Origin override: true makes CloudFront send the policy value, while Origin override: false makes it send the origin value. If the origin omits the header, CloudFront adds the policy header in either mode.

Key facts

• Amazon CloudFront uses a response headers policy to specify HTTP headers that it removes or adds in responses sent to viewers, according to its response headers policy reference.
• Each custom header in the policy has its own Origin override setting. The CloudFront API reference for ResponseHeadersPolicyCustomHeader describes Override as a Boolean.
• With true, CloudFront adds the policy's custom header and ignores the matching header received from the origin.
• With false, CloudFront includes the matching custom header received from the origin.
• If the origin response has no matching custom header, CloudFront adds the policy header for either setting.

How does Origin override choose the value?

The Amazon CloudFront response headers policy reference gives the field a Boolean meaning. For a custom header present in both places, the policy value wins when the field is true. The origin value wins when the field is false. The CloudFront API reference describes Override as determining whether CloudFront overrides a response header with the same name received from the origin with the header specified in the policy.

Origin override: true
Origin override: false

The field applies to each custom header separately. A policy can therefore use one setting for one header and another setting for a different header. The source describes the custom header value as optional, because CloudFront can add a response header with no value.

What happens when the origin omits the header?

The same CloudFront reference says that CloudFront adds the custom header from the policy when the origin response does not contain that header. This happens with both Origin override: true and Origin override: false. The false setting therefore preserves an origin value when one exists, while still supplying the policy header when the origin supplies no matching field.

The custom headers section also says that CloudFront adds configured custom headers to every response that it returns to viewers. The setting controls the conflict between an origin header and a policy header; it does not turn the policy header into an origin request header.

Does header removal change the result?

CloudFront's response headers policy documentation documents a processing order for headers listed for removal and headers configured elsewhere in the same policy. CloudFront removes the listed headers first, then adds headers from the CORS, security, custom header, and other sections. If a header appears in both the removal list and another policy section, the response includes the header added by that other section.

For a custom header, the resulting policy value still follows its own Origin override setting when a matching origin header is present. The remove setting does not create a third value source.

Related terms

• What happens when a CloudFront policy removes and adds the same response header?
• Does adding Cache-Control through a CloudFront response policy change edge caching?
• How can CloudFront apply a robots header only to a selected URL path?

FAQ

Does Origin override: false always preserve the origin value?

It preserves the origin value when the origin response contains the custom header named in the policy. When that header is absent from the origin response, CloudFront adds the policy header.

What does Origin override: true do to a matching origin header?

It makes CloudFront add the custom header configured in the policy and ignore the matching header received from the origin. The viewer receives the policy value.

Can the same custom header be removed and added in one policy?

Yes. CloudFront documents removal first and addition from another policy section afterward, so a custom header configured in the policy is included in the response.

Sources

1. Amazon Web Services, "Understand response headers policies", accessed 17 October 2026
2. Amazon Web Services, "ResponseHeadersPolicyCustomHeader", accessed 17 October 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer