Header Validator

A Traefik middleware plugin that validates request headers against expected values. If a header is missing or has an incorrect value, the request is rejected with a 401 Unauthorized response.

Dynamic Configuration

Once the plugin is declared, you can configure the middleware.

File (YAML)

http:
  middlewares:
    my-header-validator:
      plugin:
        headervalidator:
          headers:
            X-API-Key: "my-secret-key"
            X-Tenant-ID: "tenant-123"

  routers:
    my-router:
      rule: Host(`example.com`)
      service: my-service
      middlewares:
        - my-header-validator
      entryPoints:
        - web

  services:
    my-service:
      loadBalancer:
        servers:
          - url: http://127.0.0.1:8080

Docker Labels (Local Plugin Mode)

For development/testing before publishing to the Traefik Plugins Catalog:

version: "3"

services:
  traefik:
    image: traefik:v3.0
    command:
      - "--experimental.localPlugins.headervalidator.moduleName=github.com/Weheba/headervalidator"
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./plugins-local:/plugins-local

  my-service:
    image: nginx
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.my-service.rule=Host(`example.com`)"
      - "traefik.http.routers.my-service.entrypoints=web"
      - "traefik.http.routers.my-service.middlewares=my-header-validator"
      - "traefik.http.middlewares.my-header-validator.plugin.headervalidator.headers.X-API-Key=my-secret-key"

Place the plugin source in:

./plugins-local/
    └── src
        └── github.com
            └── Weheba
                └── headervalidator
                    ├── headervalidator.go
                    ├── go.mod
                    └── .traefik.yml

Configuration Options

Option	Type	Required	Description
headers	map[string]string	Yes	Map of header names to their expected values. All headers must match for the request to pass.

Behavior

• All headers must match: Every header defined in the configuration must be present in the request with the exact expected value.
• Missing header: Returns 401 Unauthorized
• Wrong value: Returns 401 Unauthorized
• All valid: Request passes through to the next handler