# Http-request add-header

**URL:** <https://discourse.haproxy.org/t/http-request-add-header/9647>\
**Category:** Help!\
**Created:** [March 21, 2024, 12:39am UTC](https://discourse.haproxy.org/t/http-request-add-header/9647 "2024-03-21T00:39:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![porton](https://avatars.discourse-cdn.com/v4/letter/p/22d042/32.png) [@porton](https://discourse.haproxy.org/u/porton)\
**Post date:** [March 21, 2024, 12:39am UTC](https://discourse.haproxy.org/t/http-request-add-header/9647/1 "2024-03-21T00:39:51Z")

</div>

I need help

I am using the following configuration to route traffic to different backends; however, the backend host is the same host for both applications. Everything works fine as long as a user does not try to log into both applications in the same browser. it is almost as if the browser confuses where the response is coming from or makes a request using cookies from the wrong site.

```auto
global
        log /dev/log local0 
        # log /dev/log local1 info
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

        # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

        # SSL Tunabel 
        tune.ssl.default-dh-param 4096
        
        # Match ingress-nginx large-client-header-buffers 4 32k
        tune.bufsize 32768

defaults
        log global
        mode http
        option forwardfor
        option httplog
        option dontlognull
        timeout connect 600s
        timeout client 600s
        timeout server 600s
        timeout tunnel 43200s
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

# frontend prometheus
# bind *:8405
# http-request use-service prometheus-exporter if { path /metrics }
# no log

frontend app-fe
        bind *:80
        bind *:443 ssl crt /etc/haproxy/certs/
        mode http
        http-request redirect scheme https unless { ssl_fc }

        http-request set-header X-Forwarded-Proto https if { ssl_fc }
        http-request set-header X-Forwarded-Proto http unless { ssl_fc }

        # DEV ACL
        acl dev_url req.hdr(host) -i -m beg dev.
        http-request set-header X-Forwarded-Port %[dst_port] if dev_url

        # QA ACL
        acl qa_url req.hdr(Host) -i -m beg qa.
        http-request set-header X-Forwarded-Port %[dst_port] if qa_url

        # Route traffic to DEV
        use_backend dev-be if dev_url
        # Route traffic to QA 
        use_backend qa-be if qa_url

        # default_backend dev-be

backend dev-be
        option forwardfor if-none
        mode http
        balance roundrobin
        cookie LB1SESSIONID insert indirect nocache

        ## The rule below ensures that the Location header is https if for some reason it changes to http. Ignores relative path Locations.
        http-response replace-header Location ^http://(.*)$ https://\1
        ## The server directive is configured to trust the certificate regardless of its type or expiration date     
        server dev-ingress A.elb.us-east-1.amazonaws.com:443 cookie dev-be check ssl verify none

backend qa-be
        # option forwardfor
        mode http
        balance roundrobin
        cookie LB2SESSIONID insert indirect nocache

        ## The rule below ensures that the Location header is https if for some reason it changes to http. Ignores relative path Locations.
        http-response replace-header Location ^http://(.*)$ https://\1

        ## The server directive is configured to trust the certificate regardless of its type or expiration date     
        server qa-ingress A.elb.us-east-1.amazonaws.com:443 cookie qa-be check ssl verify none

```

haproxy version: HAProxy version 2.4.24-0ubuntu0.22.04.1 2023/10/31

Thanks.

---

<div class="post-metadata">

**Author:** ![porton](https://avatars.discourse-cdn.com/v4/letter/p/22d042/32.png) [@porton](https://discourse.haproxy.org/u/porton)\
**Post date:** [March 25, 2024, 2:21pm UTC](https://discourse.haproxy.org/t/http-request-add-header/9647/2 "2024-03-25T14:21:35Z")

</div>

Anyone has any ideas why this configuration might not be keeping requests going to each back end and responses from each back end separate?

I apologize for the question’s title, kind of misleading but where my head was at the time I was writing the note.  
Thanks,

---

<div class="post-metadata">

**Author:** ![jbrahy](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/jbrahy/32/525_2.png) [@jbrahy](https://discourse.haproxy.org/u/jbrahy)\
**Post date:** [March 26, 2024, 7:56pm UTC](https://discourse.haproxy.org/t/http-request-add-header/9647/3 "2024-03-26T19:56:31Z")

</div>

Just a shot in the dark here but have you tried sticky sessions?

> **[2 Ways to Enable Sticky Sessions in HAProxy (Guide)](https://www.haproxy.com/blog/enable-sticky-sessions-in-haproxy)**
>
> In this blog post, you will learn how HAProxy supports sticky sessions. You can choose to implement them either with a cookie or with the user’s IP address.

---

<div class="post-metadata">

**Author:** ![porton](https://avatars.discourse-cdn.com/v4/letter/p/22d042/32.png) [@porton](https://discourse.haproxy.org/u/porton)\
**Post date:** [April 17, 2024, 8:16pm UTC](https://discourse.haproxy.org/t/http-request-add-header/9647/4 "2024-04-17T20:16:35Z")

</div>

Hi, I am using cookie based sticky sessions.

Since I posted this I found out that z-Scaler is upstream from HAProxy and I got a feeling tit is “eating” the X-Forwarded-\* headers thus HAProxy can’t really stick the session to anything. That’s my guess.