aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.SecurityHeadersConfigProperty

SecurityHeadersConfigProperty Struct

A configuration for a set of security-related HTTP response headers.

CloudFront adds these headers to HTTP responses that it sends for requests that match a cache behavior associated with this response headers policy.

Source

Generated code

Type last changed

v2.93.0 · 23 Aug 2023

Example

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_cloudfront as cloudfront } from 'aws-cdk-lib';
const securityHeadersConfigProperty: cloudfront.CfnResponseHeadersPolicy.SecurityHeadersConfigProperty = {
  contentSecurityPolicy: {
    contentSecurityPolicy: 'contentSecurityPolicy',
    override: false,
  },
  contentTypeOptions: {
    override: false,
  },
  frameOptions: {
    frameOption: 'frameOption',
    override: false,
  },
  referrerPolicy: {
    override: false,
    referrerPolicy: 'referrerPolicy',
  },
  strictTransportSecurity: {
    accessControlMaxAgeSec: 123,
    override: false,

    // the properties below are optional
    includeSubdomains: false,
    preload: false,
  },
  xssProtection: {
    override: false,
    protection: false,

    // the properties below are optional
    modeBlock: false,
    reportUri: 'reportUri',
  },
};

Properties

contentSecurityPolicyIResolvable | CfnResponseHeadersPolicy.ContentSecurityPolicyPropertycontent_security_policytyping.Union[IResolvable, ContentSecurityPolicyProperty]contentSecurityPolicyIResolvableContentSecurityPolicyIResolvableContentSecurityPolicyinterface{}#

The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header.

For more information about the Content-Security-Policy HTTP response header, see Content-Security-Policy in the MDN Web Docs.

contentTypeOptionsIResolvable | CfnResponseHeadersPolicy.ContentTypeOptionsPropertycontent_type_optionstyping.Union[IResolvable, ContentTypeOptionsProperty]contentTypeOptionsIResolvableContentTypeOptionsIResolvableContentTypeOptionsinterface{}#

Determines whether CloudFront includes the `X-Content-Type-Options` HTTP response header with its value set to `nosniff` .

For more information about the X-Content-Type-Options HTTP response header, see X-Content-Type-Options in the MDN Web Docs.

frameOptionsIResolvable | CfnResponseHeadersPolicy.FrameOptionsPropertyframe_optionstyping.Union[IResolvable, FrameOptionsProperty]frameOptionsIResolvableFrameOptionsIResolvableFrameOptionsinterface{}#

Determines whether CloudFront includes the `X-Frame-Options` HTTP response header and the header's value.

For more information about the X-Frame-Options HTTP response header, see X-Frame-Options in the MDN Web Docs.

referrerPolicyIResolvable | CfnResponseHeadersPolicy.ReferrerPolicyPropertyreferrer_policytyping.Union[IResolvable, ReferrerPolicyProperty]referrerPolicyIResolvableReferrerPolicyIResolvableReferrerPolicyinterface{}#

Determines whether CloudFront includes the `Referrer-Policy` HTTP response header and the header's value.

For more information about the Referrer-Policy HTTP response header, see Referrer-Policy in the MDN Web Docs.

strictTransportSecurityIResolvable | CfnResponseHeadersPolicy.StrictTransportSecurityPropertystrict_transport_securitytyping.Union[IResolvable, StrictTransportSecurityProperty]strictTransportSecurityIResolvableStrictTransportSecurityIResolvableStrictTransportSecurityinterface{}#

Determines whether CloudFront includes the `Strict-Transport-Security` HTTP response header and the header's value.

notes

For more information about the Strict-Transport-Security HTTP response header, see Security headers in the Amazon CloudFront Developer Guide and Strict-Transport-Security in the MDN Web Docs.

xssProtectionIResolvable | CfnResponseHeadersPolicy.XSSProtectionPropertyxss_protectiontyping.Union[IResolvable, XSSProtectionProperty]xssProtectionIResolvableXssProtectionIResolvableXssProtectioninterface{}#

Determines whether CloudFront includes the `X-XSS-Protection` HTTP response header and the header's value.

For more information about the X-XSS-Protection HTTP response header, see X-XSS-Protection in the MDN Web Docs.