Change how HTTP requests and responses pass through a tunnel: add fixed headers, set the Host header your service receives, put a path in front of every request, set the request timeout, and choose HTTPS only or HTTP/3 for the public address.
Before you start #
- An HTTP tunnel. See HTTP / HTTPS.
- The settings are in the tunnel's settings panel: open My Tunnels › HTTP and select Settings in the row of the tunnel.
| Setting | HTTP | MCP Gateway |
|---|---|---|
| Headers | Yes | – |
| Rewrite Path? | Yes | – |
| HTTP Timeout | Yes | Yes |
| Is Only Https? | Yes | Yes |
| Is HTTP/3 Active? | Yes | Yes |
None of these settings restarts the tunnel. A change is applied to the running tunnel as soon as you save it.
HTTP headers #
Headers › Manage opens the HTTP headers dialog. It adds fixed headers to the traffic that passes through the tunnel:
- Request headers reach your local service with every request.
- Response headers reach the visitor with every response.
Values are sent exactly as you type them.
Add a header #
-
Choose the header type #
Select Request headers or Response headers at the top of the dialog. Each tab shows how many headers it holds.
-
Add the header #
Select Add header and fill in Name and Value, or select a name under Suggestions to get a row with a sensible starting value. For a header the dialog knows, the information icon in the row explains what it does.
-
Save #
Select Save. To remove a header, select the remove button of its row, then Save.
Ready-made sets #
On the Response headers tab, Ready-made sets add a group of headers in one step. The dialog then says "NAME added. Check the values, then save." A set fills in a header that is already in the list only if its value is empty.
| Set | Headers it adds | Use it for |
|---|---|---|
| Allow CORS |
| Lets web apps on other sites call this tunnel. |
| Security headers |
| HSTS, nosniff, frame protection and referrer policy. |
| Turn off caching | Cache-Control: no-store | Keeps browsers and proxies from caching responses. |
| Hide from search engines | X-Robots-Tag: noindex, nofollow | Asks search engines not to list this address. |
Suggested headers #
| Header | Type | What the dialog says about it |
|---|---|---|
Host | Request | Your service receives this host name instead of the tunnel address. Useful when a local web server picks the site by host name. |
Authorization | Request | Sends the same credentials to your service with every request. |
X-API-Key | Request | A fixed key for services that expect one in a header. |
X-Forwarded-Proto | Request | Tells your app that visitors use HTTPS, so it builds https:// links and redirects. |
Origin | Request | Some services only accept requests from a known origin. |
Access-Control-Allow-Origin | Response | Which websites may call this tunnel from a browser. * allows any site. |
Access-Control-Allow-Credentials | Response | Lets browsers send cookies. It does not work together with Access-Control-Allow-Origin: *. |
Strict-Transport-Security | Response | Tells browsers to always use HTTPS for this address. |
X-Frame-Options | Response | Stops other sites from showing your pages in a frame. |
Content-Security-Policy | Response | Controls where pages may load scripts, styles and images from. A strict policy can break pages, so test it. |
Cache-Control | Response | no-store keeps browsers and proxies from caching responses. |
X-Robots-Tag | Response | Asks search engines not to list this address. |
The suggestions also include User-Agent, Accept-Language and Cache-Control for requests, and Access-Control-Allow-Methods, Access-Control-Allow-Headers, X-Content-Type-Options, Referrer-Policy and Permissions-Policy for responses. You can type any other header name as well.
Rules #
- Header names can use letters, numbers and dashes, for example
X-Api-Key, and can be up to 256 characters long. - A name can appear once per tab. A second row with the same name is refused with "NAME is already in this list."
- A row needs a name. An empty row is ignored when you save.
Host header #
By default your service receives the tunnel address as the host name of a request. To send another host name, add the request header Host in the HTTP headers dialog and set its value to the name your service expects, for example localhost or shop.internal.
Use this when a local web server picks the site by host name, such as an Apache or nginx virtual host, IIS with host bindings, or a development server that only answers for localhost. See Virtual hosts for a full example.
Rewrite path #
A path rewrite adds a path in front of every request before it reaches your local service. Visitors keep using the short address.
-
Switch Rewrite Path? to Yes #
The Rewrite path dialog opens.
-
Enter the path to add #
Type it into Path to add, for example
/apior/app/v2, or select one of the Common paths. The path starts with a slash; if you leave the slash out, it is added for you. The Example box shows the result for a sample request. -
Save #
Select Save.
With /api as the path:
| Visitor opens | Your service gets |
|---|---|
https://<YOUR_TUNNEL_ADDRESS>/orders?id=7 | /api/orders?id=7 |
A tunnel has one path, up to 200 characters. It cannot contain spaces and cannot be just /. To remove it, switch Rewrite Path? to No and confirm Turn off path rewrite?: the saved path is removed and requests reach your service with their original path.
HTTP Timeout #
HTTP Timeout › Manage opens the Request timeout dialog. The timeout is how long the tunnel waits for your service to answer a request. After that, the visitor gets a timeout error.
| Item | Values |
|---|---|
| Timeout | A whole number from 1 to 600 seconds. Leave it empty for the server default. |
| Presets | Server default, 30 s, 1 min, 2 min, 5 min, 10 min |
Raise the timeout for slow reports, large uploads or long polling. Choose Server default to go back to the standard value.
Is Only Https? #
Switch Is Only Https? to Yes and confirm Turn on HTTPS only? to serve the public URL over HTTPS only. Use it for anything that carries logins or personal data, so no one reaches the tunnel over plain HTTP.
Is HTTP/3 Active? #
Switch Is HTTP/3 Active? to Yes to let clients reach the public URL over HTTP/3. Clients that do not support HTTP/3 keep using the earlier HTTP versions.
Examples #
Let a web app on another site call your API #
Your front end runs on https://app.example.com and calls an API behind a tunnel. Open Headers › Manage, go to Response headers and select Allow CORS. Replace the * of Access-Control-Allow-Origin with https://app.example.com if only that site may call the API, then select Save.
Publish an app that lives under a sub-path #
Your application server serves the app under /app/v2, and you want visitors to open the plain tunnel address. Switch Rewrite Path? on and enter /app/v2. A visitor who opens /login reaches /app/v2/login on your service.
The same settings through the API #
These settings are also available under /api/v2/tunnels/<TUNNEL_ID>/: headers, host-header, path-rewrite, http-timeout, https-only and http3. See API.
Troubleshooting #
"Header names can use letters, numbers and dashes, for example X-Api-Key."
The name contains a character that is not allowed in a header name, such as a space or a colon. Enter only the name in Name and the rest in Value.
"Add a name for this header, or remove the row."
A row has a value but no name. Fill in the name or remove the row.
"Enter only the path, without http:// and the host name."
Path to add takes a path such as /api, not a full URL.
"Enter a whole number from 1 to 600, or choose Server default."
The timeout must be between 1 and 600 seconds. For a longer job, answer the request first and let the client ask for the result later.
My CORS header does not work with cookies
Access-Control-Allow-Credentials does not work together with Access-Control-Allow-Origin: *. Set Access-Control-Allow-Origin to the exact origin of the calling site.
My local service uses HTTPS and the tunnel shows an error
That is not a header problem. Turn on Is SslStream?, which tells the tunnel that your local service itself uses HTTPS. See Settings reference.
