Outbound response headers are one of the components of HTTP response message headers. They can carry specific response parameters and pass the parameters to clients, and can be used to control various types of client behavior, such as cache behavior, cross-origin access, content types, and download methods. By modifying outbound response headers, when users request resources under an accelerated domain name, the response message returned by DCDN carries the response headers that you configured, which enables specific features such as cross-origin access.
Note: When this feature references rule conditions from the Rules Engine, the execution order follows the priority order of the rule conditions configured in the Rules Engine, NOT the priority order of this feature's own configuration.
How it works
HTTP response headers control caching behavior. When a client requests a resource from a POP, the returned headers determine how both the client and POP cache the response.
The HTTP response header configuration is a domain-level configuration. After the configuration takes effect, it applies to the response messages of all resources under the domain.
Configuring HTTP response headers affects only the response behavior of the client (for example, a browser) and does not affect the caching behavior of DCDN nodes.If the accelerated domain name is a wildcard domain name, modifying outbound response headers is not supported.
Scenarios
-
Specify resource types. For example, add the
Content-Type: text/htmlheader to indicate an HTML response. -
Enable cross-origin resource sharing (CORS): Add the Access-Control-Allow-Origin header to responses from DCDN-accelerated domain names. For more information, see Configure cross-origin resource sharing.
DCDN also supports authentication on cross-origin requests through custom CORS rules.
-
Customize response behavior: Add or modify headers to implement specific features or adjust response content based on business requirements.
Notes
-
Multiple configurations are executed from top to bottom in the order they appear in the configuration list. The effects are cumulative. If multiple configurations modify the same header, the last one takes precedence. In the following example, Configuration 2 is the one that takes effect:
-
Configuration 1: Add the HTTP response header:
cache-control: max-age=3600 -
Configuration 2: Add the HTTP response header:
cache-control: no-cache
-
-
When rule conditions are applied, matching is determined by the priority of the conditions, not the order of the configurations.
Procedure
-
Log on to the DCDN console.
-
In the left-side navigation pane, click Domain Names.
-
On the Domain Names page, find the target domain name and click Configure.
-
In the left-side navigation tree of the domain name, click Caching.
-
On the Custom Outgoing Response Header tab, click Add. Then configure the following parameters.
Parameter
Description
Operation
Add, delete, change, or replace response headers.
Response Header
Select a response header. For more information, see Response headers.
Description
Description of the selected HTTP header.
Response Header Name
If you set Response Header to Custom Header, you need to specify a header name:
-
The name must contain letters, digits, and hyphens (-).
-
The name must be 1 to 100 characters in length.
Header Value
The value of the response header. For more information, see Response headers.
Allow Duplicates
-
Yes: Both the origin server header and the configured header are returned to the client.
-
No: The configured header overwrites the origin server header.
Rule Condition
A rule condition allows a rule to be applied only when a request meets specific criteria.
-
Do not use: Disables conditional rules.
-
You can add or edit conditional rules in the Rules engine.
CORS
Disabled by default. Available only when Operation is set to Add and Response Header is set to Access-Control-Allow-Origin.
-
Enable: POPs check the Origin header in requests and set Access-Control-Allow-Origin based on CORS rules.
-
Disable: POPs skip the Origin header check and return the configured Access-Control-Allow-Origin value.
-
-
Click OK.
In the response header list, click Modify or Delete to modify or delete a header.
CORS rules
The Allow Duplicates and CORS settings are mutually exclusive. Setting Allow Duplicates to Yes invalidates Yes.
-
Wildcard match: If Access-Control-Allow-Origin is set to *, the response always returns Access-Control-Allow-Origin:* regardless of the Origin header value.
-
Exact match: Specify one or more values for Access-Control-Allow-Origin, separated by commas (,).
-
If the Origin header matches a specified value, the matching origin is returned in the response.
-
If no match is found, Access-Control-Allow-Origin is not returned.
-
-
Wildcard domain match: If Access-Control-Allow-Origin is set to a wildcard domain, the Origin header is matched against it.
For more information, see Configure cross-origin resource sharing.
Response headers
|
Response header |
Description |
Example |
|
Custom Header |
Create a custom response header with the following rules:
|
Test-Header |
|
Content-Type |
Specifies the content type returned to the client. |
text/html |
|
Cache-Control |
Specifies the caching policy for requests and responses. |
no-cache |
|
Content-Disposition |
Default filename when the response is saved as a file. |
examplefile.txt |
|
Content-Language |
Specifies the intended audience language. |
en-US |
|
Expires |
Specifies when the response expires. |
Wed, 21 Oct 2015 07:28:00 GMT |
|
Pragma |
An HTTP/1.0 implementation-specific header compatible with HTTP/1.1. Effects vary along the request-response chain. |
no-cache |
|
Access-Control-Allow-Origin |
Specifies origins allowed for cross-origin requests. Use * to allow all origins, or enter specific domains such as Note
|
|
|
Access-Control-Allow-Methods |
Specifies allowed request methods for cross-origin requests. Separate multiple methods with commas (,). |
POST,GET |
|
Access-Control-Allow-Headers |
Specifies allowed header fields for cross-origin requests. |
X-Custom-Header |
|
Access-Control-Max-Age |
Specifies how long the results of a preflight request can be cached. Unit: seconds. |
600 |
|
Access-Control-Expose-Headers |
Specifies headers exposed to the client in the response. |
Content-Length |
|
Access-Control-Request-Method |
Indicates the HTTP method used in the actual request. Sent by browsers during preflight requests. |
POST |
|
Access-Control-Request-Headers |
Indicates the HTTP headers used in the actual request. Sent by browsers during preflight requests. |
X-PINGOTHER |
|
Access-Control-Allow-Credentials |
Specifies whether CORS requests can include credentials.
|
true |