This is kind of a theoretical question, and I guess it may be too broad or unclear.

Foobar is an application serving users across the internet. It relies on a CDN to improve its resiliency, speed, etc to serve people wherever they are.

  • Are the HTTP headers (received by the client) defined by the CDN, or by the Foobar application (implying the CDN will forward them)?

  • If both are possible, what are the pros and cons of either?

  • depends on your CDN
    – user253751
    Nov 28, 2022 at 19:57

1 Answer 1


There is no universal answer. What gets done with/to headers depends both on the request, the specific CDN, the specific header and your site configuration (that includes both the headers your backend/origin server includes in the response and how you configure your site in the CDN).

Assume that by default the majority of headers will be stripped from the response generated by a back-end/origin server and only a (minimal) subset of headers will be set in the response sent by the CDN.

Some (CDN specific) headers might be added by the CDN according to your policies or by default. For example Fastly adds a x-served-by: header by default and CloudFront allows you to set and optional Server-Timing: header to facilitate debugging CDN operations.

Some headers might be preserved from your back-end server. For example Cache-control: and Expires: headers are fairly common ones. See for example: Cloud Front docs

Some might be adjusted by the CDN in specific ways. For example see how Fastly deals with a Date: header set in the origin.

Reasons to set headers at the CDN

Rather than allowing each application to do their own thing, or not do anything you set a single policy for all your sites and applications at the CDN level.

Good examples are CORS and HSTS policies.

You may choose to only set/add a specific header at the CDN when the origin does not, but use the value from the origin if it is set there.

etc. etc.

Reasons to preserve headers set at the origin

The application (developer) knows best what the application needs.

Overriding the default caching policy with a Cache-Control: private, no-store is a text book example that comes to mind.

etc. etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .