Set Response Headers
Config File Key:
Type: map of
stringskey value pairs
X-Content-Type-Options : nosniff,
Strict-Transport-Security:max-age=31536000; includeSubDomains; preload,
Set Response Headers specifies a mapping of HTTP Header to be added globally to all managed routes and pomerium's authenticate service.
By default, conservative secure HTTP headers are set:
max-age=31536000instructs the browser to pin the certificate for a domain for a year. This helps prevent man-in-the-middle attacks, but can create issues when developing new environments with temporary certificates. See Troubleshooting - HSTS for more information.
includeSubDomainsapplies these rules to subdomains, which is how individual routes are defined.
preloadinstructs the browser to preload the certificate from an HSTS preload service if available. This means that the certificate can be loaded from an already-trusted secure connection, and the user never needs to connect to your domain without TLS.
See MDN Web Docs - Strict-Transport-Security for more information.
Several security-related headers are not set by default since doing so might break legacy sites. These include:
Cross-Origin Resource Policy,
Cross-Origin Opener Policy and
Cross-Origin Embedder Policy. If possible users are encouraged to add these to
set_response_headers or their downstream applications.