I am currently trying to improve my HAProxy HTTPS configuration. There seems to be two ways to set additional fields to response headers in HAProxy. I currently use http-response set-header, which should, if I understand it right:

  1. Check if the field exist
  2. If it exists, delete it
  3. Set the field to the new value

Some people use rspadd instead, which should simply append the field at the end of the response header.

When working with sensitive fields like for HSTS, set-header feels safer on the paper. Is there any real difference between both ? If yes which one should I prefer when setting sensitive fields in my headers ?


The http-response commands are newer (added in 1.5), adding additional functionality and flexibility to the older rspadd/rspdel/etc commands. While they'll both work, it's probably better to stick with http-response for future-compatibility.


You use them depending on what you need: add to add a new value, set to replace it. If there is sensitive data that can be injected into the headers, of course you are going to use set-header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.