add-headers
Adds headers to the request on its way to your service, or to the response on its way back.
| Phases | on_http_requeston_http_response |
| Terminating | No — the next action runs after it. |
| Cost | Free |
Example
policy.yaml
on_http_response:
- name: HardenSecurityHeaders
actions:
- type: add-headers
config:
headers:
x-frame-options: DENY
x-content-type-options: nosniff
strict-transport-security: "max-age=31536000; includeSubDomains"
Start an agent endpoint with it: devgate http 8080 --traffic-policy-file policy.yaml, or paste it into a
reserved or cloud endpoint’s Traffic Policy tab in the dashboard.
Configuration
| Field | Type | Description |
|---|---|---|
headers required | map | 1 to 10 header names and values. Values may use ${…} interpolation, e.g. ${conn.client_ip}. |
Behaviour
- Header names are case-insensitive and stored lowercase.
- In on_http_request, a host header replaces the Host your service receives — the same as --host-header.
- user-agent and the browser-warning skip headers can’t be set by a policy.
Other actions
remove-headers compress-response basic-auth oauth openid-connect jwt-validation custom-response deny redirect url-rewrite restrict-ips rate-limit circuit-breaker verify-webhook http-request set-vars log close-connection forward-internal