Header rules

A header rule adds, sets, or deletes a single HTTP header on requests or responses for URLs that match its URL operator. Leave the match value empty to apply the rule globally.

Fields

Field	Type	Required	Notes
name	string	Yes	Display name.
pattern	string	No	The match value. Empty = global (applies to every request). Max length 500.
matchType	integer	No	Equals=0, Contains=1, StartsWith=2, EndsWith=3, Regex=4. Defaults to Contains (1).
action	integer	Yes	Add=0, Set=1, Delete=2. See Actions.
headerName	string	Yes	The header to manipulate. Max length 200. Validated against protected headers and character restrictions — see below.
headerValue	string	Conditional	Required for Add and Set; not needed for Delete. Max length 4000. Must not contain CR/LF or null bytes.
applyToRequest	boolean	No	false (default) = response header; true = request header.
order	integer	Yes	Lower runs first. See how rules work.
isEnabled	boolean	Yes	Toggle without deleting.

Actions

action	UI label	Behavior	headerValue
0	Add	Adds the header.	Required
1	Set/Replace	Sets the header, replacing any existing value.	Required
2	Delete	Removes the header.	Not used

There is no separate "Replace" action

The shipped enum has only Add=0, Set=1, and Delete=2. The panel labels Set as "Set/Replace" because setting already replaces an existing value — there is no separate Replace value. Use Set (1) to overwrite.

Request vs. response

The applyToRequest toggle decides which side the header is applied to:

• applyToRequest: false (default) — modifies the response sent to the client.
• applyToRequest: true — modifies the request the edge sends upstream to your origin.

Header name and value restrictions

Both headerName and headerValue are validated server-side to prevent HTTP response splitting and other injection attacks:

• headerName must contain only RFC 7230 token characters: letters, digits, and !#$%&'*+-.^_|~`. Names with spaces, control characters, or other symbols are rejected.
• headerValue must not contain carriage returns (\r), line feeds (\n), or null bytes (\0). These characters could be used for HTTP response splitting.

If either field contains invalid characters, the panel rejects the rule with a descriptive error.

Protected headers

Some headers are CDN-controlled and can't be changed by your rules. If you pick a protected header, the panel won't let you save the rule.

Examples

Add a response header to every request

Leave the pattern empty so the rule applies to every request. In the property's Rules tab, click Add header rule and set:

• Action: Add
• Header name: X-Custom-Header
• Header value: served-by-paradarum
• Apply to: Response
• Pattern: empty (all requests)

Delete a header, scoped to a path

Strip X-Powered-By from responses only under /api/:

• Action: Delete (no value needed)
• Header name: X-Powered-By
• Match: Starts with /api/
• Apply to: Response

CORS for HLS playback

A common use is adding an Access-Control-Allow-Origin response header so players can fetch HLS segments cross-origin. See the HLS examples for a complete CORS rule set.

Next steps

• HLS examples — header rules for CORS on streaming responses.
• Match operators — scope a header rule to specific URLs.
• API reference — full request and response schemas.