NonStandardResponseHeaders | Streams Platform Client Api

Hierarchy

NonStandardResponseHeaders

Index

Properties

Optional Content-Security-Policy,X-Content-Security-Policy,X-WebKit-CSP

Content-Security-Policy,X-Content-Security-Policy,X-WebKit-CSP?: string

Content Security Policy definition.

example: X-WebKit-CSP: default-src 'self'

Optional Expect-CT

Expect-CT?: string

Notify to prefer to enforce Certificate Transparency.

example: Expect-CT: max-age=604800, enforce, report-uri="https://example.example/report"

Optional NEL

NEL?: string

Used to configure network request logging.

example: NEL: { "report_to": "name_of_reporting_group", "max_age": 12345, "include_subdomains": false, "success_fraction": 0.0, "failure_fraction": 1.0 }

Optional Permissions-Policy

Permissions-Policy?: string

To allow or disable different features or APIs of the browser.

example: Permissions-Policy: fullscreen=(), camera=(), microphone=(), geolocation=(), interest-cohort=()

Optional Refresh

Refresh?: string

Used in redirection, or when a new resource has been created. This refresh redirects after 5 seconds. Header extension introduced by Netscape and supported by most web browsers. Defined by HTML Standard

example: Refresh: 5; url=http://www.w3.org/pub/WWW/People.html

Optional Report-To

Report-To?: string

Instructs the user agent to store reporting endpoints for an origin.

example: Report-To: { "group": "csp-endpoint", "max_age": 10886400, "endpoints": [ { "url": "https-url-of-site-which-collects-reports" } ] }

Optional Status

Status?: string

CGI header field specifying the status of the HTTP response. Normal HTTP responses use a separate "Status-Line" instead, defined by RFC 7230.

example: Status: 200 OK

Optional Timing-Allow-Origin

Timing-Allow-Origin?: string

The Timing-Allow-Origin response header specifies origins that are allowed to see values of attributes retrieved via features of the Resource Timing API, which would otherwise be reported as zero due to cross-origin restrictions.

example: Timing-Allow-Origin: * Timing-Allow-Origin: [, ]*

Optional X-Content-Duration

X-Content-Duration?: string

Provide the duration of the audio or video in seconds; only supported by Gecko browsers

example: X-Content-Duration: 42.666

Optional X-Content-Type-Options

X-Content-Type-Options?: string

The only defined value, "nosniff", prevents Internet Explorer from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions.

example: X-Content-Type-Options: nosniff

Optional X-Powered-By

X-Powered-By?: string

Specifies the technology (e.g. ASP.NET, PHP, JBoss) supporting the web application (version details are often in X-Runtime, X-Version, or X-AspNet-Version)

example: X-Powered-By: PHP/5.4.0

Optional X-Redirect-By

X-Redirect-By?: string

Specifies the component that is responsible for a particular redirect.

example: X-Redirect-By: WordPressX-Redirect-By: Polylang

Optional X-Request-ID,X-Correlation-ID

X-Request-ID,X-Correlation-ID?: string

Correlates HTTP requests between a client and server.

example: X-Request-ID: f058ebd6-02f7-4d3f-942e-904344e8cde5

Optional X-UA-Compatible

X-UA-Compatible?: string

Recommends the preferred rendering engine (often a backward-compatibility mode) to use to display the content. Also used to activate Chrome Frame in Internet Explorer. In HTML Standard, only the IE=edge value is defined.

example: X-UA-Compatible: IE=edgeX-UA-Compatible: IE=EmulateIE7X-UA-Compatible: Chrome=1

Optional X-XSS-Protection

X-XSS-Protection?: string

Cross-site scripting (XSS) filter

example: X-XSS-Protection: 1; mode=block