Learn Traefik - Headers & Security Middlewares

#Introduction

HTTP headers are the silent language between the browser and the server. Traefik's headers middleware gives you full control over that language: adding, removing, or replacing headers on both the request and response paths. Episode 10 covers this middleware thoroughly, plus two big themes: the security headers suite and CORS.

Why does this matter? Many classic web attacks — clickjacking, MIME sniffing, CSP-based XSS — are prevented not by the application, but by correct headers. Installing security headers in Traefik means all services behind it are protected at once, without changing a single line of application code. That is the value of a proxy as a centralized control point.

#The Headers Middleware

#Custom Request and Response Headers

The headers middleware has four option groups: customRequestHeaders, customResponseHeaders, plus options to remove both. The headers middleware configuration always lives under http.middlewares:

http:
  middlewares:
    app-headers:
      headers:
        customRequestHeaders:
          X-Source: "traefik-edge"
        customResponseHeaders:
          X-Powered-By: "Backend Cluster"
          Cache-Control: "no-store"
        customRequestHeadersRegex:
          X-User-{name}: "{value}"

• customRequestHeaders: added to the request before being forwarded to the backend — useful for marking traffic origin or adding headers the backend needs.
• customResponseHeaders: added to the response before being sent to the client.
• The Regex variants allow dynamic templates with capture groups from the request.

#Browser XSS Filter and Content Type Sniffing

Two older but still useful protections are enabled through dedicated options:

http:
  middlewares:
    old-school-protect:
      headers:
        customResponseHeaders:
          X-XSS-Protection: "1; mode=block"
          X-Content-Type-Options: "nosniff"

X-Content-Type-Options: nosniff forbids the browser from guessing content types (MIME sniffing) — an important prevention for file upload based attacks.

#Security Headers

#Modern Standards

The suite of modern security headers recommended for nearly every web service:

http:
  middlewares:
    secure:
      headers:
        contentSecurityPolicy: "default-src 'self'; frame-ancestors 'none'"
        frameDeny: true
        contentTypeNosniff: true
        browserXssFilter: true
        referrerPolicy: "no-referrer"
        permissionsPolicy: "camera=(), microphone=(), geolocation=()"
        forceSTSHeader: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true

• Content-Security-Policy: the list of sources allowed to load content — the main defense against XSS. Set default-src 'self' then loosen it according to application needs.
• X-Frame-Options / frameDeny: prevents your site from being displayed in another site's iframe (anti-clickjacking).
• X-Content-Type-Options: prevents MIME sniffing.
• Referrer-Policy: controls what URL information is sent when navigating away.
• Permissions-Policy: restricts browser features such as camera, microphone, and geolocation.

For applications that do not use these headers at all, attaching the middleware above to every router already significantly improves the security posture. CSP settings that are too strict can break an application — test on staging first.

#CORS Middleware

#Allowing Cross-Site Origins

CORS (Cross-Origin Resource Sharing) governs whether the browser may call your API from another domain. Traefik's cors middleware configures this centrally:

http:
  middlewares:
    api-cors:
      headers:
        accessControlAllowOriginList:
          - "https://app.example.com"
          - "https://staging.example.com"
        accessControlAllowMethods:
          - GET
          - POST
          - OPTIONS
        accessControlAllowHeaders:
          - Content-Type
          - Authorization
        accessControlAllowCredentials: true
        accessControlMaxAge: 3600

• accessControlAllowOriginList: the list of allowed origins — never use a wildcard together with credentials.
• accessControlAllowMethods: allowed methods.
• accessControlAllowHeaders: headers a cross-origin request may send.
• accessControlAllowCredentials: true: allows cross-origin cookies.
• accessControlMaxAge: how long the browser caches a preflight result.

#Preflight Handling

For complex requests, the browser first sends a preflight OPTIONS request. Traefik handles preflight automatically when the CORS middleware is active: if the method and headers match the configuration, Traefik replies with 204 without forwarding the request to the backend. This saves backend load and speeds up browser responses.

#HSTS

#Forcing HTTPS in the Browser

HSTS (HTTP Strict Transport Security) tells the browser: "from now on, only access this site over HTTPS". This prevents downgrade and SSL stripping attacks. Its configuration was already visible in the security headers section: stsSeconds is the policy duration in seconds, stsIncludeSubdomains extends it to all subdomains, and stsPreload registers the domain in the browser preload list.

The correct HSTS rollout rules:

• Start with a small stsSeconds, e.g. 300 seconds, for testing.
• Make sure HTTPS works fully before raising it to 31536000 seconds.
• Only enable stsPreload once confident — removal from the preload list is very difficult.

#Closing

Key takeaways:

• The headers middleware manages custom request and response headers.
• Security headers: CSP, frameDeny, nosniff, referrerPolicy, permissionsPolicy.
• CORS is configured centrally, complete with automatic preflight.
• HSTS forces HTTPS; start with a short duration then increase gradually.
• Headers are applied once at Traefik, protecting all backends at once.
• Do not use a wildcard origin together with credentials.

In episode 11 next we will cover path & request middlewares — AddPrefix, StripPrefix, ReplacePath, ReplacePathRegex, RedirectScheme to force HTTPS, and RedirectRegex for pattern-based redirects. These are the middlewares that align public URLs with an application's internal structure.