How to migrate from Legacy Cache Settings to AWS-Recommended Cache and Origin Request Policies with Authorization Header
We are currently using the Legacy Cache Settings. In this configuration, we have the Authorization header included and Query Strings = ALL. Now, I want to move to the AWS-recommended Cache Policy and Origin Request Policy. I successfully created a Cache Policy that includes the Authorization header. However, when I try to include the Authorization header in the Origin Request Policy, I get the following error: "The parameter Headers contains Authorization that is not allowed." I have two main questions: 1: In the Legacy Cache Settings, is the Authorization header being forwarded to the cache, the origin, or both? How can I verify this? 2: What is the correct way to migrate to the new AWS-recommended policies while continuing to use the Authorization header?
I attached the Screenshot below:
- Newest
- Most votes
- Most comments
Considering this:
- Use "All Viewer Headers" in Origin Request Policy – This ensures the Authorization header is forwarded, but it may introduce performance trade-offs.
- Include Authorization in Cache Policy – If you add the Authorization header to the cache key, CloudFront automatically forwards it to the origin.
- Use Signed Cookies or Query Strings – Instead of relying on Authorization headers, consider using signed cookies or query strings for authentication.
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/header-caching.html
Hey,
Hope you're keeping well.
In the legacy cache settings, the Authorization header is always forwarded to the origin and, if included in the cache key, used for cache differentiation as well. You can confirm this by checking your CloudFront distribution’s behavior settings in the console under Behaviors > Edit, where the header forwarding configuration is shown. In the new policy model, Authorization cannot be explicitly listed in an Origin Request Policy due to its sensitive nature, but if you add it to the cache key in a Cache Policy, CloudFront automatically forwards it to the origin.
Thanks and regards,
Taz
answered 10 months ago
Relevant content
- AWS OFFICIALUpdated 2 years ago
Using "All Viewer Headers" in the origin request policy would forward all headers to the origin, which is not what I want. I believe that including the Authorization header in the cache policy is the best solution for my use case, as it ensures only the necessary header is forwarded without impacting cache performance. Thank you very much for the guidance.