Setting up hiding of origin headers

Written by

Updated at September 14, 2026

You can set up hiding of origin headers when creating a CDN resource or updating its settings using the management console or API.

Warning

Hiding headers that affect how the client processes the response, such as Content-Type, can interfere with your web application's performance. When enabling this option, add the required headers to the allowed list.

Management console

REST API

gRPC API

In the management console, select the folder where your resource is located.
Navigate to Cloud CDN.
Click the resource name.
Navigate to the HTTP headers and methods tab.
In the top-right corner, click Edit.
Under Client response headers, in the Hiding of origin headers field, select Hide all except listed.
In the Headers to keep field, specify the headers you want to provide to clients, e.g., Content-Type.
Click Save.

To enable the option, add the headerFilter section when using the create or update method for a Resource:

"headerFilter": {
  "enabled": "<true_or_false>",
  "headers": [
    "<header_list>"
  ]
}

Where:

enabled: Enabling the option:
- true enables the option.
- false disables the option.
headers: A list of HTTP headers to be passed to the client. All other origin headers will be hidden.

To enable the option, add the header_filter section when using the ResourceService/Create or ResourceService/Update call:

"header_filter": {
  "enabled": "<true_or_false>",
  "headers": [
    "<header_list>"
  ]
}

Where:

enabled: Enabling the option:
- true enables the option.
- false disables the option.
headers: A list of HTTP headers to be passed to the client. All other origin headers will be hidden.

It may take up to 15 minutes for the new settings of the existing resource to apply to the CDN servers. After that, we recommend purging the resource cache.

Example

In this example, a CDN resource is created for a corporate portal that should hide technical headers from the source to enhance security. Only the main headers required for the correct functioning of the web application are allowed.

Get an IAM token for API authentication and write it into a variable:
```
export IAM_TOKEN=`yc iam create-token`
```

Create a CDN resource with a configured header hiding:

cURL

gRPCurl

curl \
  --request POST \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://cdn.api.cloud.yandex.net/cdn/v1/resources' \
  --data '{
    "folderId": "b12m81qm6abc********",
    "cname": "cdn-portal.example.com",
    "origin": {
      "originSourceParams": {
        "source": "portal.example.com",
        "meta": {
          "common": { "name": "portal.example.com" }
        }
      }
    },
    "originProtocol": "HTTPS",
    "options": {
      "headerFilter": {
        "enabled": true,
        "headers": [
          "Content-Type",
          "Cache-Control",
          "Content-Length",
          "Last-Modified",
          "ETag"
        ]
      }
    }
  }'

Result:

{
"done": true,
"metadata": {
  "@type": "type.googleapis.com/yandex.cloud.cdn.v1.CreateResourceMetadata",
  "resourceId": "bc8rgivxwhcy********"
},
"response": {
  "@type": "type.googleapis.com/yandex.cloud.cdn.v1.Resource",
  "active": true,
  "options": {
  ...
  "headerFilter": {
    "enabled": true,
    "headers": [
    "Content-Type",
    "Cache-Control",
    "Content-Length",
    "Last-Modified",
    "ETag"
    ]
  }
  },
  ...
},
"id": "bc8y2mnkri2d********",
"description": "Create resource",
"createdAt": "2026-02-05T18:02:30.735628Z",
"createdBy": "aje9k8luj4qf********",
"modifiedAt": "2026-02-05T18:02:30.735628Z"
}

grpcurl \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "folder_id": "b12m81qm6abc********",
        "cname": "cdn-portal.example.com",
        "origin": {
          "origin_source_params": {
            "source": "portal.example.com",
            "meta": {
              "common": { "name": "portal.example.com" }
            }
          }
        },
        "origin_protocol": "HTTPS",
        "options": {
          "header_filter": {
            "enabled": true,
            "headers": [
              "Content-Type",
              "Cache-Control",
              "Content-Length",
              "Last-Modified",
              "ETag"
            ]
          }
        }
      }' \
  cdn.api.cloud.yandex.net:443 \
  yandex.cloud.cdn.v1.ResourceService/Create

Result:

{
  "id": "bc8h7teov4q7********",
  "description": "Create resource",
  "createdAt": "2026-02-05T18:19:01.262477Z",
  "createdBy": "aje9k8luj4qf********",
  "modifiedAt": "2026-02-05T18:19:01.262477Z",
  "done": true,
  "metadata": {"@type":"type.googleapis.com/yandex.cloud.cdn.v1.CreateResourceMetadata","resourceId":"bc8r4gogfqeb********"},
  "response": {..."options":{..."headerFilter":{"enabled":true,"headers":["Content-Type","Cache-Control","Content-Length","Last-Modified","ETag"]}},...}
}

Setting up hiding of origin headers

ExampleExample

Was the article helpful?

Example