---
title: "HAProxy Configuration Settings"
slug: "haproxy-configuration-settings"
tags: ["Configuration", "HAproxy", "security policy", "Settings", "header"]
updated: 2024-10-29T13:10:14Z
published: 2024-10-29T13:10:14Z
canonical: "docs.revealdata.com/haproxy-configuration-settings"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revealdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HAProxy Configuration Settings

[HAProxy](http://www.haproxy.org/) configurations can be adjusted by making changes to */etc/brainspace/haproxy/brainspace-haproxy.cfg* on the Application Server.

We advise that before making any changes to this file you create a backup of the current file in case you need to revert back.

We also recommend, if going to make changes to the brainspace-haproxy.cfg file, that you refer to the HAProxy documentation found here: [https://cbonte.github.io/haproxy-dconv/1.8/configuration.html.](https://cbonte.github.io/haproxy-dconv/1.8/configuration.html)

A common place that changes are made to enhance security is:

### **Content-Security-Policy Header**

Brainspace does not come pre-configured with any CSP headers since the configuration for many of them are specific to the environment where Brainspace is deployed. CSP Headers can be added to the [HAProxy](http://www.haproxy.org/) configuration to meet your security policies.

Examples of other headers already in the default HAProxy configuration:

#### Strict-Transport-Security http-response set-header Strict-Transport-Security max-age=86400;\ includeSubDomains;

## OWASP Best Practices: (https://www.owasp.org/index.php/OWASP_Secure_Headers_Project) http-response add-header X-Content-Type-Options nosniff http-response add-header X-Permitted-Cross-Domain-Policies none

An example of Cache Control and Pragma http headers that could be added:

## Cache Control http-response add-header Cache-Control max-age=0\ no-cache\ no-store\ private\ must-revalidate http-response add-header Pragma no-cache

> **Note**
> 
> All examples given are just examples and are not recommendations. You should only apply changes as needed and within your company’s security policy and guidelines.

Additionally, any changes made to the *brainspace-haproxy.cfg* file may need to be re-added after any upgrade to a new version of Brainspace is performed.

## Related

- [HAProxy with Brainspace](/haproxy-with-brainspace.md)
- [Changing Port for Tomcat](/changing-port-for-tomcat.md)
- [Replacing the Default Brainspace Self-Signed SSL Certificates](/replacing-the-default-brainspace-self-signed-ssl-certificates.md)
- [Brainspace Security Policy](/brainspace-security-policy.md)