{"action":"created","issue":{"url":"https://api.github.com/repos/mholt/caddy/issues/666","repository_url":"https://api.github.com/repos/mholt/caddy","labels_url":"https://api.github.com/repos/mholt/caddy/issues/666/labels{/name}","comments_url":"https://api.github.com/repos/mholt/caddy/issues/666/comments","events_url":"https://api.github.com/repos/mholt/caddy/issues/666/events","html_url":"https://github.com/mholt/caddy/issues/666","id":139638997,"number":666,"title":"Add ability to overwrite headers","user":{"login":"stp-ip","id":3768412,"avatar_url":"https://avatars.githubusercontent.com/u/3768412?v=3","gravatar_id":"","url":"https://api.github.com/users/stp-ip","html_url":"https://github.com/stp-ip","followers_url":"https://api.github.com/users/stp-ip/followers","following_url":"https://api.github.com/users/stp-ip/following{/other_user}","gists_url":"https://api.github.com/users/stp-ip/gists{/gist_id}","starred_url":"https://api.github.com/users/stp-ip/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stp-ip/subscriptions","organizations_url":"https://api.github.com/users/stp-ip/orgs","repos_url":"https://api.github.com/users/stp-ip/repos","events_url":"https://api.github.com/users/stp-ip/events{/privacy}","received_events_url":"https://api.github.com/users/stp-ip/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mholt/caddy/labels/help%20wanted","name":"help wanted","color":"159818"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2016-03-09T17:03:53Z","updated_at":"2016-03-30T02:36:45Z","closed_at":null,"body":"As prerequisite we have the header ```content-security-policy: policy```\r\n\r\nRight now one can either strip a header:\r\n```header / -content-security-policy```\r\nResulting in no ```content-security-policy``` header\r\n\r\nOr add something to a header:\r\n```header / content-security-policy \"some policy\"```\r\nResulting in  ```content-security-policy: policy some policy```\r\n\r\nBut one can not overwrite a header:\r\n```header / content-security-policy \"some policy\"```\r\nResulting in  ```content-security-policy: some policy```\r\n\r\nMy suggestion would be to have  ```-content-security-policy``` strip the header,  ```+content-security-policy``` add to a header already available and  ```content-security-policy``` to overwrite it. This would break compatibility, but in my opinion makes it clearer."},"comment":{"url":"https://api.github.com/repos/mholt/caddy/issues/comments/203205367","html_url":"https://github.com/mholt/caddy/issues/666#issuecomment-203205367","issue_url":"https://api.github.com/repos/mholt/caddy/issues/666","id":203205367,"user":{"login":"stp-ip","id":3768412,"avatar_url":"https://avatars.githubusercontent.com/u/3768412?v=3","gravatar_id":"","url":"https://api.github.com/users/stp-ip","html_url":"https://github.com/stp-ip","followers_url":"https://api.github.com/users/stp-ip/followers","following_url":"https://api.github.com/users/stp-ip/following{/other_user}","gists_url":"https://api.github.com/users/stp-ip/gists{/gist_id}","starred_url":"https://api.github.com/users/stp-ip/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stp-ip/subscriptions","organizations_url":"https://api.github.com/users/stp-ip/orgs","repos_url":"https://api.github.com/users/stp-ip/repos","events_url":"https://api.github.com/users/stp-ip/events{/privacy}","received_events_url":"https://api.github.com/users/stp-ip/received_events","type":"User","site_admin":false},"created_at":"2016-03-30T02:36:45Z","updated_at":"2016-03-30T02:36:45Z","body":"Thanks for keeping me involved. Yes I agree with @p4tin. The general idea is great. The only thing to take into account is the sequence of caddy and middleware plugins/modules/add-ons. Headers set in caddy itself need to be applied last. Middleware can only remove, add or replace headers, but only before caddy's headers are set. So If a header is removed/set/or added in caddy it needs to overwrite the middleware."}}