How do I remove or modify HTTP response headers in CloudFront?

Short description

Choose one of the following resolutions based on the response header that you want to modify or remove:

• To unconditionally modify or remove the value of a Server header, use a response headers policy.
• To modify the value of a Server header for a specific condition, use a CloudFront function.
• To remove an X-Forwarded-Host or X-Forwarded-Server header, use custom headers.
• You can't remove or modify the X-Cache header. The X-Cache header must remain because it shows the header's source, such as the CloudFront cache, a function, or an origin.

Note: CloudFront adds its own Server and X-Cache headers to responses that it sends to viewers. CloudFront adds the headers even when you use a response headers policy to remove the headers from the origin response.

Resolution

Use a response headers policy to modify or remove a Server header

To modify a Server header, complete the following steps:

1. Open the CloudFront console.
2. In the navigation pane, choose Policies, and then choose the Response headers tab.
3. Choose Create response headers policy.
4. In the Details section, for Name, enter a name for your policy.
5. In the Custom headers section, choose Add header.
6. For Name, enter Server.
7. For Value, enter your Server header value.
8. Select the Origin override option for your custom Server header, and then choose Create.
9. Attach the response headers policy to the behavior that you want in your CloudFront distribution.

CloudFront deploys the changes and then overrides the Server header value with the custom value that you specified in the policy.

To remove a Server header, complete the following steps:

1. Open the CloudFront console.
2. In the navigation pane, choose Policies, and then choose the Response headers tab.
3. Choose Create response headers policy.
4. In the Details section, for Name, enter a name for your policy.
5. In the Remove headers section, choose Add header.
6. For Name, enter Server, and then choose Create.
7. Attach the response headers policy to the behavior that you want in your CloudFront distribution.

CloudFront deploys the changes and then replaces the Server header value with the CloudFront value.

Use a CloudFront Function to modify the Server header for a specific condition

To override the Server header value with your custom value for the behavior that you specify for a specific condition, complete the following steps:

1. Open the CloudFront console.
2. In the navigation pane, choose Functions, and then choose Create function.
3. For Name, enter a name for your function.
4. For Runtime, choose cloudfront-js-2.0.
5. Choose Create function.
6. In the Development tab of the code editor, enter the following code:

   function handler(event) {
       var response = event.response;
       var headers = response.headers;
   
       if ('server' in headers && headers.server.value === 'YOUR_CONDITIONAL_VALUE') {
           headers.server.value = 'YOUR_CUSTOM_VALUE';
       }
   
       return response;
   }

   Note: Replace YOUR_CONDITIONAL_VALUE with your conditional value and YOUR_CUSTOM_VALUE with your Server header value.
7. Choose Save changes.
8. Associate the function with the behavior that you want in your CloudFront distribution.

The CloudFront Function overrides the Server header with your custom value for the behavior in the specific condition that you defined in the function.

Use custom headers to remove the "X-Forwarded-Host" or "X-Forwarded-Server" header

Complete the following steps:

1. Create a Lambda@Edge function.

2. Add a trigger for the Lambda@Edge function.
   The following example function in Node.js removes the X-Forwarded-Host and X-Forwarded-Server headers:

   export const handler = async (event) => {
       const response = event.Records[0].cf.response;
       const headers = response.headers;
   
       // Remove X-Forwarded-Host header
       delete headers['x-forwarded-host'];
   
       // Remove X-Forwarded-Server header
       delete headers['x-forwarded-server'];
   
       return response;
   };

3. Deploy the Lambda@Edge function, and then associate the function with your CloudFront distribution's viewer request trigger.

4. Use the trigger to remove the specified headers before you forward requests to the origin.

Related information

Understand response headers policies

Customize at the edge with CloudFront Functions

Customize at the edge with Lambda@Edge