Orange's CDN provides two options for controlling response headers: Response headers (add) adds custom HTTP headers to CDN server responses, and Response headers (hide) removes specific origin headers before delivery.
Add response headers
The Response headers (add) option sets custom HTTP headers that CDN servers include in responses to end users. If the same header is already configured on the origin server, the CDN server overrides its value.
3. In the left panel, click HTTP headers to expand the section, then click Response headers (add) to jump to the option.
4. Enable the Add response headers toggle.
ℹ️
Up to 50 response headers can be added per resource.
5. In the Header name field, enter a header name.
6. In the Value field, enter the header value.
7. The Always add the header to response from CDN regardless of response code checkbox is enabled by default, which adds the header to all responses. To add the header only to responses with codes 200, 201, 204, 206, 301, 302, 303, 304, 307, and 308, uncheck the box.
8. Click Add header to add more headers. Fill in the fields for each additional header.
9. Click Save changes.
Add multiple header values
To add more than one value to the same header, enter them in the Value field in one of two ways:
Separate header values: enter a value and press Enter before adding the next one.
The response header appears as:
Example: one
Example: two
Example: three
Comma-separated value: enter multiple values separated by commas without pressing Enter.
The response header appears as:
Example: one, two, three
Both methods can be combined: enter comma-separated values, press Enter, and then add another value.
The response header appears as:
Example: one, two
Example: three
Valid characters for fields:
Header name: Latin letters (A–Z, a–z), numbers (0–9), underscore (_) and hyphen (-)
Value: Latin letters (A–Z, a–z), numbers (0–9), a space, and these characters: ~!@#%^&*()-_=+ /|";:?.><{}[]
Value field restrictions:
Invalid characters: $'
The value must start with a letter, number, asterisk (*), or opening brace ({)
Cannot contain only special characters
Check headers
After saving the configuration, verify the header appears in CDN responses.
1. Clear the cache of the CDN resource or files for which the header was added.
2. Run this cURL command, substituting the file URL:
curl -I https://cdn.site.com/images/1.jpg
HTTP/2 200
X-Custom-Header: header-value
3. If the response contains the configured header, the setup is complete.
Hide response headers
By default, a CDN server passes all HTTP headers it receives from the origin server to end users. To control which headers are included in responses:
1. In the Customer Portal, navigate to CDN → CDN resources.
2. Click the resource to open its settings.
3. In the left panel, click HTTP headers to expand the section, then click Response headers (hide) to jump to the option.
4. Enable the Hide response headers toggle.
5. Select a mode:
Hide all except — set the headers to keep in the response; all other headers are hidden. After enabling, the most common headers appear pre-filled. Remove headers by clicking the × icon, or add headers by clicking the HTTP headers row and selecting from the list or entering a name. Header names accept letters (a–z), numbers (0–9), dashes (-), and underscores (_).
Hide only — set the headers to hide from the response; all other headers are kept. Click the HTTP headers row and select from the list or enter custom header names.
ℹ️
The following headers are mandatory and cannot be hidden: connection, content-length, content-type, server, and date.
6. Click Save changes.
Add custom headers to CDN responses, or hide selected origin headers before the response is delivered.
ℹ️
An API token is required. The CDN resource ID is visible under CDN → CDN Resources, or from the resources list call.
Use static_response_headers to add headers. The older staticHeaders field is not used for new configurations. Use response_headers_hiding_policy to hide origin headers. Set enabled to false to turn either option off.
Open a terminal and export the required variables:
Set options.static_response_headers. Each item in value is one header. Strings in that item's value array are separate header values. A comma inside one string stays part of that single value. always set to false adds the header only to responses with codes 200, 201, 204, 206, 301, 302, 303, 304, 307, and 308. always set to true adds it to every response. A resource accepts up to 50 headers. The name uses letters, numbers, hyphens, and underscores. The value must start with a letter, number, asterisk (*), or opening brace ({).
After the option is saved, clear the cache and request the file. The header is present when the CDN response includes it.
Add a custom response header and hide origin headers with the Terraform provider v2. CDN responses include each value of X-Custom-Header as a separate header. always set to false adds the header only to responses with codes 200, 201, 204, 206, 301, 302, 303, 304, 307, and 308. Clear the cache after terraform apply, then request the file.
Response headers
Set static_response_headersenabled to true. Each object in value is one header, and each string in that object's value is a separate header value. A resource accepts up to 50 headers. The value must start with a letter, number, asterisk (*), or opening brace ({). modehide is Hide all except: the headers in excepted stay, and the stored list also includes connection, content-length, content-type, date, and server. modeshow is Hide only: it removes the headers in excepted. Set excepted to x-robots-tag to remove that header, then run terraform apply.
