title: Apache: difference between "Header always set" and "Header set"?
body: <h2>Questions</h2>
  <ol>
  <li>What is the difference between <code>Header always set</code> and <code>Header set</code> in Apache?</li>
  <li>That is, what does the <code>always</code> keyword change about the circumstances under which the header is set?</li>
  <li>Should I always set my headers using <code>always</code>?</li>
  <li>Is there any reason not to?</li>
  </ol>
  <h2>Background</h2>
  <p>I've seen...</p>
  <pre><code>Header always set X-Frame-Options DENY
  </code></pre>
  <p>...as well as...</p>
  <pre><code>Header always set Access-Control-Allow-Headers &quot;*&quot;
  </code></pre>
  <p>...and I sometimes hear that the presence of the <code>always</code> keyword ensures that the header is properly set, or that it's simply better to include the <code>always</code> keyword in general. However, I have never found a clear, definitive answer for <em>why</em> that is the case.</p>
  <p>I've already checked the <a href="http://httpd.apache.org/docs/current/mod/mod_headers.html" rel="noreferrer">Apache docs for <code>mod_headers</code></a>, which only briefly mention <code>always</code>:</p>
  <blockquote>
  <p>When your action is a function of an existing header, you may need to specify a condition of always, depending on which internal table the original header was set in. The table that corresponds to always is used for locally generated error responses as well as successful responses. Note also that repeating this directive with both conditions makes sense in some scenarios because always is not a superset of onsuccess with respect to existing headers:</p>
  <ul>
  <li>You're adding a header to a locally generated non-success (non-2xx) response, such as a redirect, in which case only the table corresponding to always is used in the ultimate response.</li>
  <li>You're modifying or removing a header generated by a CGI script, in which case the CGI scripts are in the table corresponding to always and not in the default table.</li>
  <li>You're modifying or removing a header generated by some piece of the server but that header is not being found by the default onsuccess condition.</li>
  </ul>
  </blockquote>
  <p>As far as I can tell, this means that <code>Header set always</code> ensures that the header is set even on non-200 pages. However, my HTTP headers set with <code>Header set</code> have always seemed to apply just fine on my 404 pages and such. Am I misunderstanding something here?</p>
  <p>FWIW, I've found SO posts like <a href="https://stackoverflow.com/q/36991188/560642">What is the difference between &quot;always&quot; and &quot;onsuccess&quot; in Apache&#39;s Header config?</a>, but the only answer there didn't really explain it clearly for me.</p>
  <p>Thanks very much,<br />
  Caleb</p>