Overwrite response headers with conditional check of request headers

[rex007]

Recently moved from Azure to GCP.
Azure has Rule sets in Front Door and CDN settings which can be used to do comparisons of request headers and overwrite response header if condition passes.
Use Case: Check if request is from origin1.domain.com, then overwirte access-control-allow-origin to *.
We were using it to fix CORS issue.

What is the correct way to do this in GCP?

[Marvin_Lucero]

Hi @rex007 ,

You will be needing to use Cloud Storage, Load Balancer and a Cloud Armor. 

- Cloud Storage to host your static content, such as web pages and images.
- The Load Balancer makes sure that incoming visitors are evenly distributed across your backend services. You configure your backend service to point to the Cloud Storage bucket.
- Cloud Armor is used to set up a security policy with rules that change response headers based on conditions like request headers. For example, you define a rule that checks whether the request is from origin1.domain.com and, if so, modifies the Access-Control-Allow-Origin header accordingly.

Here is the approach :
1. Set up a Load Balancer (either HTTP(S) or TCP/UDP).
2. On the security policy, you can choose specific conditions by customizing how you match request headers.
2. Define custom security policies using Cloud Armor for your LB. You can configure Cloud Armor to add or modify response headers if a request header condition is met, say for example, the request is fromorigin1.domain.com.

# Sample Google Cloud Armor security policy YAML
securityPolicies:
- name: custom-header-modification-policy
rules:
- priority: 1000
match:
expr:
originHeaderMatches:
origins:
- 'origin1.domain.com'
action:
requestHeadersAction:
setHeaders:
- 'Access-Control-Allow-Origin: *'

 After this, you have to associate the security policy with the LB.