AWS CloudFront Error: Headers That Disappear, Reappear, or Mutate at the Edge

#aws#cloudfront#devops#cloud

How CloudFront requests work correctly at the origin but behave inconsistently at the edge due to header forwarding rules, cache keys, and CORS interactions

Problem

Requests served through Amazon CloudFront behave differently than requests sent directly to the origin. Expected headers are missing, unexpected headers appear, or responses vary unpredictably between users. CORS errors occur even though the origin appears correctly configured.

---

Clarifying the Issue

CloudFront does not forward all headers by default.
Instead, CloudFront:

• Filters headers based on the Origin Request Policy
• Splits cache entries based on the Cache Policy
• Injects its own headers (for example, geolocation and device metadata)

This means CloudFront can legitimately return a response that never hit your origin, even though the incoming request contained different headers.

Most header-related issues are not bugs.
They are configuration mismatches between forwarding rules and cache keys.

---

Why It Matters

Header misconfigurations cause subtle, high-friction failures:

• CORS errors that only affect browsers
• Authentication failures due to missing headers
• “Works in curl, fails in browser” scenarios
• S3 breakage caused by forwarding unsafe headers

Because headers influence both routing and caching, mistakes here are amplified across the edge.

---

Key Terms

• Request Headers – Headers sent from the client to CloudFront
• Response Headers – Headers returned from the origin or injected at the edge
• Cache Key – The specific set of request attributes CloudFront uses to identify cached objects
• Origin Request Policy – Controls which headers are forwarded to the backend
• Cache Policy – Controls which headers are included in cache differentiation
• CORS (Cross-Origin Resource Sharing) – Browser security mechanism enforced through headers

---

Steps at a Glance

1. Identify which headers are missing or inconsistent
2. Check header forwarding rules
3. Verify cache key alignment
4. Validate CORS behavior end-to-end
5. Re-test with caching in mind

---

Detailed Steps

Step 1: Identify the Missing or Mutating Header

Start by comparing:

1. A request sent directly to the origin
2. The same request sent through CloudFront

Common symptoms:

• Authorization header missing at the origin
• CloudFront-injected headers such as CloudFront-Viewer-Country appearing unexpectedly
• Browser-only failures not reproducible with curl

Actions:

• Log incoming headers at the origin
• Capture request and response headers from CloudFront
• Compare results side by side

Do not assume CloudFront forwarded what the client sent.

---

Step 2: Check Header Forwarding (Origin Request Policy)

By default, CloudFront forwards very few headers to improve cache efficiency.

Common failures:

• Expecting Authorization to be forwarded automatically
• Selecting “Forward All Headers” without understanding the consequences

Critical S3 Warning:
Never forward the Host header to an S3 origin.
S3 expects the bucket endpoint as the host, not your custom domain. Forwarding Host will cause 400 or 404 errors.

Actions:

• Inspect the Origin Request Policy attached to the cache behavior
• Explicitly allow only the headers the backend actually needs
• Use managed policies for S3 where appropriate

If a header is not forwarded, the origin will never see it.

---

Step 3: Verify Cache Key Alignment (Cache Policy)

Forwarding a header does not automatically add it to the cache key.

If a header affects the response but is excluded from the cache key:

• CloudFront will reuse a cached response generated with a different header value
• Users may receive incorrect or inconsistent content

Common examples:

• Accept-Language
• Authentication or feature-flag headers

Actions:

• Include any header that changes response content in the Cache Policy
• Keep cache keys minimal but accurate

Misaligned cache keys are the most common cause of “random” behavior.

---

Step 4: Validate CORS Behavior

CORS failures are almost always header and cache related.

Common causes:

• Origin header not forwarded to the origin
• Access-Control-Allow-Origin cached incorrectly
• Preflight (OPTIONS) responses cached unintentionally

Actions:

• Forward the Origin header explicitly
• Ensure CORS responses vary correctly by origin
• Disable caching or use very low TTLs for preflight requests

A correct origin CORS configuration can still fail if CloudFront caches the wrong response.

---

Step 5: Re-Test With Caching in Mind

Header fixes do not always apply immediately.

Actions:

• Invalidate affected paths after fixing configuration
• Test with different header values
• Confirm whether responses are cache hits or misses

Do not test header behavior using a single cached response.

---

Pro Tips

• Forward ≠ Cache: A header can be forwarded without being cached on
• Never forward Host to S3: This breaks bucket routing
• CloudFront-added headers are expected: They are features, not bugs
• CORS is a cache problem: Not just a browser problem
• Fix first, invalidate second

---

Conclusion

When headers behave strangely in CloudFront, the system is usually doing exactly what it was configured to do.

The most common causes are:

1. Origin Request Policy stripping required headers
2. Cache Policy ignoring headers that change content
3. Unsafe header forwarding (especially Host with S3)

Once request policies and cache keys are aligned, header behavior at the edge becomes predictable and stable.

---

Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.