Kong: preserve_host controls which Host header the upstream sees

By default Kong replaces Host with the upstream's own hostname. Services that build absolute URLs - redirects, OIDC callbacks, pagination links - need the client's Host instead.

Code

# default: upstream sees Host: billing.internal
curl -X PATCH http://localhost:8001/routes/billing-route \
  --data preserve_host=false

# upstream sees Host: api.example.com (what the client asked for)
curl -X PATCH http://localhost:8001/routes/billing-route \
  --data preserve_host=true

Output

preserve_host=false:
  Location: http://billing.internal:8080/invoices/42     <- leaked to the browser

preserve_host=true:
  Location: https://api.example.com/billing/invoices/42

# The other half of this is X-Forwarded-Proto: an upstream behind TLS
# termination sees plain HTTP and will build http:// URLs unless it trusts
# the forwarded header.

Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.

Published 2026-08-25