How can I configure CloudFront to forward the Authorization header to the origin?

Short description

Configure your distribution to forward the Authorization header to the origin in one of these ways:

• Create a cache policy. Then, associate the cache policy with the cache behavior that must forward the Authorization header.
  Note: If caching is turned off, then you can use AllViewer and AllViewerExceptHostHeader origin request policies to forward an authorization header.
• Edit an existing cache behavior with legacy cache settings.
• If the caching option is turned off, then use an origin request policy.

Important: For Amazon Simple Storage Service (Amazon S3) origins, caching based on the Authorization header isn't supported. For more information, see Select the headers to base caching on.

Resolution

Create a cache policy

Complete the following steps:

1. Use the CloudFront console to create a cache policy.
2. Under Cache key settings, for Headers, choose Include the following headers. Then, under Add Headers, select Authorization.
3. Based on the requirements of the behavior, configure all other cache policy settings. Then, choose Create.
4. Attach the policy to the relevant behavior of your CloudFront distribution.

Edit an existing cache behavior with legacy cache settings

Complete the following steps:

1. Open the CloudFront console, and then choose your distribution.
2. Choose the Behaviors tab, and then select the path that you want to forward the Authorization header to.
3. Choose Edit.
4. Under Headers, choose Include the following headers. Then, under Add Headers, select Authorization.
5. Choose Save changes.

Use an origin request policy

You can use an origin request policy to forward all viewer headers to your origin. You must forward all viewer headers for CloudFront to include the Authorization header in viewer requests.

Related information

HTTP request headers and CloudFront behavior (custom and Amazon S3 origins)