Technical Tip: remove-from-response in web-proxy fails to remove multiple headers from HTTP response

When multiple HTTP headers are configured in the web-proxy profile entry to be removed from an HTTP response, only the first header is removed from the HTTP response.

config firewall policy

    edit 1

        set type explicit-web
        set dstintf "port2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "webproxy"
        set explicit-web-proxy "wp_client"
        set webproxy-profile "wp-profile"
        set logtraffic all
        set webcache enable
        set webcache-https enable
        set profile-protocol-options "default"
        set ssl-ssh-profile "deep-inspection"

    next

end

config web-proxy profile

    edit "wp-profile"

        config headers

            edit 1

                set name "Vary"
                set action remove-from-response

            next
            edit 2

                set name "cache-control"
                set action remove-from-response

            next
            edit 3

                set name "Pragma"
                set action remove-from-response

            next

        end

    next

end

Example:

HTTP/1.1 200 OK
Date: Fri, 28 Nov 2025 06:39:09 GMT
Server: Apache/2.4.58 (Ubuntu)
Last-Modified: Fri, 14 Nov 2025 08:54:18 GMT
ETag: "29af-6438a248e8a09-gzip"
Accept-Ranges: bytes
(blank) ---> "Vary: Accept-Encoding" removed by remove-from-response
Content-Encoding: gzip
Cache-Control: no-cache, no-store, must-revalidate ---> not removed
Pragma: no-cache ---> not removed
Expires: 0
Content-Length: 3121
Content-Type: text/html

The issue that FortiProxy fails to remove headers from HTTP responses will be fixed in the following versions.

• v7.4.12 (available on the Fortinet support portal).
• v7.6.5 (available on the Fortinet support portal).