CDN:Modify incoming response headers

Use cases

Here are common use cases and examples:

• Incorrect content type: If the content type (Content-Type) returned by the origin server does not match the actual content, the client may be unable to parse it correctly. For example, an HTML file may be incorrectly marked as plain text. You can resolve this issue by configuring the origin response header.

  Example: Change Content-Type: text/plain to Content-Type: text/html.

• Cache policy control: If you need fine-grained control over the CDN caching policy, you can adjust the Cache-Control or Expires fields in the origin server's response headers. This helps optimize the content update frequency and cache hit rate.

  Example: Change Cache-Control: max-age=3600 to Cache-Control: max-age=86400 to extend the cache expiration time. For more information about the default cache rules of CDN, see Alibaba Cloud CDN Default Cache Rules and Priorities.

• Cross-Origin Resource Sharing (CORS): If you want to allow web applications from other domains to access resources hosted on the CDN, you must configure the Access-Control-Allow-Origin header and other related CORS headers on the origin server. These settings ensure that when a browser performs a cross-origin request, the CDN can provide the appropriate response headers to the client to prevent CORS errors. For more information about cross-origin access issues, see Configure Cross-Origin Resource Sharing.

  Examples:

  • Access-Control-Allow-Origin: *: Allows cross-origin resource requests from all domains.

  • Access-Control-Allow-Methods: GET, POST, OPTIONS: Specifies the HTTP methods that are allowed for cross-origin requests.

• Compressed transfer: If the origin server supports compressed transfer but has not enabled it, or if the compression algorithm used is not the most efficient, you can set the Accept-Encoding in the back-to-origin response header to instruct the origin server to use the optimal compression method.

  Example: Change Accept-Encoding: gzip, deflate to Accept-Encoding: br to prioritize Brotli compression. For more information, see Brotli Compression.

• Redirection: When your origin server needs to redirect a user to another URL, you can set the correct redirection headers in the origin response header. For more information, see Configure 301/302 redirect following.

  Example: Location: https://www.example.com/new-page.html: Notifies the CDN and the user's browser of the new resource location for 301 or 302 redirection.

• Custom origin behavior: You may need to add custom headers to the response to implement specific functions or for tracking purposes.

Notes

• Multiple configurations are executed from top to bottom in the order they appear in the configuration list. The effects are cumulative. If multiple configurations modify the same header, the last one takes precedence. In the following example, Configuration 2 is the one that takes effect:

  • Configuration 1: Add the HTTP response header: cache-control: max-age=3600

  • Configuration 2: Add the HTTP response header: cache-control: no-cache

• When rule conditions are applied, matching is determined by the priority of the conditions, not the order of the configurations.

Procedure

1. Log on to the CDN console.

2. In the left navigation pane, click Domain Names.

3. On the Domain Names page, find the target domain name and click Manage in the Actions column.

4. In the domain's navigation pane, click Origin Fetch.

5. Click the Modify Incoming Response Header tab.

6. Click Customize.

7. Modify the ingress response header settings.

   Important

   If multiple operations apply to the same origin response header parameter, the operations are executed based on the following priority: Replace > Add > Change and Delete. For example, if both an add and a delete operation are configured for the same parameter, the add operation is executed before the delete operation.

   Add response header

   Parameter	Example	Description
   Operation	add	Adds the specified response header to the origin response.
   Response Header	Custom Response Header	Select Custom Response Header or a preset response header parameter.
   Header Name	x-code	Specifies the name of the custom response header.
   Header Value	key1	Enter one or more header values, separated by commas (,).
   	key1,key2
   Allow Duplicates	Allow	Yes: Allows you to add duplicate response headers. For example, x-code:key1 and x-code:key2. No: If a header with the same name already exists, the new value overwrites the existing one. For example, if you add x-code:key1 and then x-code:key2, the final header is x-code:key2.
   Rule Condition	Do not use	A rule condition allows a rule to be applied only when a request meets specific criteria. Do not use: Disables conditional rules. You can add or edit conditional rules in the Rules engine.

   Delete response header

   Parameter	Example	Description
   Operation	delete	Removes all response headers that have the specified name, including duplicates.
   Response Header	Custom Response Header	Select Custom Response Header or a preset response header parameter.
   Header Name	x-code	Specifies the name of the custom response header to delete.
   Rule Condition	Do not use	A rule condition allows a rule to be applied only when a request meets specific criteria. Do not use: Disables conditional rules. You can add or edit conditional rules in the Rules engine.

   Modify response header

   Parameter	Example	Description
   Operation	modify	Modifies the header. This operation is not allowed if duplicate headers with the same name exist.
   Response Header	Custom Response Header	Select Custom Response Header or a preset response header parameter.
   Header Name	x-code	Specifies the name of the custom response header to modify.
   Change Value To	key1,key3	Specifies the new value for the header. To configure multiple values, separate them with commas (,).
   Rule Condition		A rule condition allows a rule to be applied only when a request meets specific criteria. Do not use: Disables conditional rules. You can add or edit conditional rules in the Rules engine.

   Replace response header

   Parameter	Example	Description
   Operation	replace	Replaces the header value. This operation is not allowed if duplicate headers with the same name exist.
   Response Header	Custom Response Header	Select Custom Response Header or a preset response header parameter.
   Header Name	x-code	Specifies the name of the custom response header whose value you want to replace.
   Find	key	A regular expression that matches the part of the header value to replace.
   Replace With	abc	The value that replaces the matched text.
   Match	Match All	Match All: Replaces all occurrences that match the regular expression. For example, if the header is x-code:key1,key2,key3 and you use a regular expression to replace the matched value key with abc, the result is x-code:abc1,abc2,abc3. Match the First Only: Replaces only the first occurrence that matches the regular expression. For example, if the header is x-code:key1,key2,key3 and you use a regular expression to replace the matched value key with abc, the result is x-code:abc1,key2,key3.
   Rule Condition	-	A rule condition specifies the criteria that a user request must meet for this configuration to apply. Do not use: No rule condition is used. To add or edit rule conditions, go to the rule engine page.

8. Click OK.

Default response headers

Alibaba Cloud CDN sets four response headers by default: Cache-Control, Content-Type, Expires, and Last-Modified. These essential HTTP protocol headers control caching, define content types, set expiration times, and record the last modified time of resources.

Configuration examples

FAQ

• For troubleshooting questions (CORS, garbled characters, download/preview, Set-Cookie, JS MIME type, and so on), see Cache troubleshooting.

• For consulting questions (origin ACAO check, precise video/mp4 configuration, JS file support, file synchronization status, and so on), see Origin fetch FAQ.