Headers

headers centralizes request and response header management.

Behavior

On the request path, request_headers are inserted into the upstream request. On the response path, response_headers are inserted into the client response. Insertions overwrite existing headers with the same name.

Invalid header names or values are skipped.

Configuration

middlewares "custom-headers" {
  type = "headers"
  request_headers = [
    { name = "X-Internal-Auth", value = env("INTERNAL_TOKEN") }
  ]
  response_headers = [
    { name = "X-Frame-Options", value = "DENY" }
  ]
}

Notes

• Do not use this middleware to forge user identity; use JWT or Forward Auth.
• Security headers such as CSP should be tuned to the frontend.

Recommended Order

middlewares = ["auth-jwt", "headers", "compress"]