Can I add, remove or change HTTP Headers in a request or response?

Short answer

Yes, on an HTTP vService with four actions: Add HTTP Header adds a new header, Set HTTP Header changes the value of the header (adds it if it does not exist), Delete HTTP Header deletes the header, and Replace HTTP Header Content changes the value with a regex. To apply it to the request, Execution Level On Request (default) is selected; to apply it to the response, On Response is selected; Execution Level cannot be changed after saving. In the Header Content field, Smart Variable can be used. The action runs once it is added to the Actions field of the vService.

Problem: Headers Need to Be Changed Without Touching the Application

It may be necessary to add a request ID for tracing, to pass additional information to the Backend Service, to correct a header in the response or to remove an unnecessary header. These changes are made without touching the application code, while the request and the response pass through TR7.

Special-Purpose Actions

There are ready-made actions for some header tasks: Manage HTTP Security Headers for security headers (Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?), HTTP Cookie Security for cookie attributes (Can I automatically add the Secure, HttpOnly and SameSite attributes to cookies?), and the X-Forwarded-For switch on the vService for the client IP (How is X-Forwarded-For enabled; what do I need to do on the backend side (Apache / Nginx / IIS logs)?).

Solution: Five Methods

The forms of the four actions are filled in with the same flow; what changes is the header operation. More than one header action can be used on the same vService; the actions are processed in their order in the Actions list.

Your situation	Suitable method
Adding a new header	Method 1: Add HTTP Header
Setting the value of a header (adding it if it does not exist), leaving a single copy	Method 2: Set HTTP Header
Removing a header	Method 3: Delete HTTP Header
Changing only part of the value	Method 4: Replace HTTP Header Content
From the command line	Method 5: WEB-CLI

Method 1: Add HTTP Header Recommended

• How it works The header is added to the request or to the response; if a header with the same name already exists, a second copy is created.
• Where it is openedLoad Balancer → Actions → Add HTTP Header
• Requirement If a condition is to be used, it is created first in Conditions
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked (how to add).

2

Adım 2 Enter the action name and type

Action Name is entered, and Action Type = Add HTTP Header is selected.

3

Adım 3 Define the header

• Execution Level: On Request (default) to add it to the request going to the Backend Service, On Response to add it to the response returning to the client. This field cannot be changed after saving.
• Header to Add: X-Request-Source.
• Header Content: TR7; a Smart Variable can be added with fx (e.g. the client IP, the request path).
• Conditions is optional; if it is left empty, the action is applied to all requests.

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

6

Adım 6 Add the action to the Actions field

The action is selected in the Details → Actions field.

7

Adım 7 Save

Save is clicked. The change is applied without dropping open connections; in a cluster, it is also sent to the peer device with the default auto-sync (if Manual Sync Mode is on, with Synchronize).

Verification

1Debug Mode LogsTR7 side

Debug is turned on on the vService; the added header appears in the header list on the Request tab of the Debug Mode Logs record.

ExpectedX-Request-Source: TR7 · green row, plus sign

2Backend ServiceBackend Service side

If the application log or the access log prints the incoming request headers, the header is seen there.

ExpectedX-Request-Source: TR7

Method 2: Set HTTP Header

• How it works All headers with the same name are deleted and a single header is written with the desired value; if the header does not exist, it is added.
• Where it is openedLoad Balancer → Actions → Set HTTP Header
• Requirement None
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Select the action type

Action Type = Set HTTP Header is selected.

3

Adım 3 Define the header

Execution Level is selected; Header to Edit = Cache-Control, Header Content = no-store (On Response).

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Edit the vService

The vService is opened with Edit.

6

Adım 6 Add the action to the Actions field

The action is selected in the Details → Actions field.

7

Adım 7 Save

Save is clicked.

Verification

1ResponseClient side

curl -sI https://www.example.com/ and the Response tab of the Debug Mode Logs record

ExpectedA single Cache-Control: no-store · the changed header is a dark orange row, right arrow sign

Method 3: Delete HTTP Header

• How it works All repetitions of the header whose name matches are deleted; letter case in the header name is not taken into account.
• Where it is openedLoad Balancer → Actions → Delete HTTP Header
• Requirement A separate action for each header
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Select the action type

Action Type = Delete HTTP Header is selected.

3

Adım 3 Write the header

Execution Level = On Response (to delete it from the response); Header to Delete = X-Powered-By.

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Edit the vService

The vService is opened with Edit.

6

Adım 6 Add the action to the Actions field

The action is selected in the Details → Actions field.

7

Adım 7 Save

Save is clicked.

Verification

1Debug Mode LogsTR7 side

The header list on the Response tab of the Debug Mode Logs record; curl -sI on the client.

ExpectedX-Powered-By red row, trash can sign · not in the curl output

Method 4: Replace HTTP Header Content

• How it works If the pattern matches in the header value, the entire value is rewritten with Replacement content; the parts to be kept are captured with a group and put back with \1. With Match Type, either the entire value or each comma-separated part is processed separately.
• Where it is openedLoad Balancer → Actions → Replace HTTP Header Content
• Requirement The pattern is case-sensitive
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Select the action type

Action Type = Replace HTTP Header Content is selected.

3

Adım 3 Define the pattern

Execution Level = On Response; Header to Replace = Location; Regex to Match = ^http://(.*)$; Match Type = Replace whole header (default); Replacement Content = https://\1. Patterns and example results: Can I change a header value with a regex?

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Edit the vService

The vService is opened with Edit.

6

Adım 6 Add the action to the Actions field

The action is selected in the Details → Actions field.

7

Adım 7 Save

Save is clicked.

Verification

1Debug Mode LogsTR7 side

A request for which the Backend Service returns a redirect is sent; the Response tab of the Debug Mode Logs record is checked.

ExpectedLocation dark orange row, right arrow sign: old http://… faded red → new https://… green

Method 5: WEB-CLI

• How it works The Add HTTP Header action is created with a WEB-CLI command and added to the vService.
• Where it is opened TR7 WEB-CLI → lb action · lb service
• Requirement WEB-CLI access; the Delete HTTP Header action is created from the interface
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Add the request header action

If --ruleLoc is not written, the action is applied to the request (atRequest):

lb action add type add_header name kaynak-ekle headerNameToAdd X-Request-Source headerContent TR7

To add it to the response, --ruleLoc atResponse is written at the end of the command.

2

Adım 2 Check the existing actions on the vService

lb service show <vService>

The rules.0, rules.1 … lines in the output show the actions on the vService in order. --rules.N replaces the action at that position; the new action is written to the first empty position.

3

Adım 3 Add the action to the vService

If the vService has two actions (0 and 1), the new action is written to position 2; if it has no actions, --rules.0 is used:

lb service update id <vService> --rules.2 kaynak-ekle

Verification

1Debug Mode LogsTR7 side

The Request tab of the Debug Mode Logs record

ExpectedX-Request-Source: TR7 · green row

Common Mistakes

• Leaving Execution Level as On Request for a response header. The default is On Request and it cannot be changed after saving; an action to be applied to the response is created again with On Response (What is the difference between On Request and On Response actions?).
• Confusing Add with Set. Add adds a second copy next to the existing header; if a single value is wanted, Set is used.
• Expecting the header in responses that TR7 itself generates. On Response header actions are applied to responses returning from the Backend Service; they do not affect the blocking, redirect, Show content and error responses that TR7 generates.
• Deleting or overwriting protocol headers. Touching headers such as Content-Length, Transfer-Encoding and Host can break connections.
• Assuming the header name will be sent as written. In HTTP/1.1, header names are forwarded converted to lowercase; if the Backend Service is sensitive to letter case: My backend is sensitive to the letter case of header names; does TR7 change them (Keep Header Names / HTTP 1.0 Header Compatibility)?

How it is done in the documentation

• Add HTTP Header · Execution Level
• Set HTTP Header · What Is the Set HTTP Header Action?
• Delete HTTP Header · Header to Delete
• Replace HTTP Header Content · Match Type
• Debug Logs · Request Tab

Related questions

• Can I change a header value with a regex?
• How do I hide headers that reveal server information, such as Server and X-Powered-By?
• What is the difference between On Request and On Response actions?