Missing headers using Azure Static Web App with staticwebapp.config.json

Per K. Jørgensen 0

We are using the "staticwebapp.config.json", where we have following:

We were expecting the headers to be set on the first response to "https://green-sea-07f102103-7937.westeurope.5.azurestaticapps.net/", but get following:

User's image

They are set on the following responses for "js/css/ico/etc.."

User's image

Per K. Jørgensen 0

The "staticwebapp.config.json":

{
  "globalHeaders": {
    "Content-Security-Policy": "default-src 'self'",
    "Content-Type": "text/html; charset=UTF-8",
    "Strict-Transport-Security": "max-age=300; includeSubDomains; preload",
    "Referrer-Policy": "strict-origin-when-cross-origin",
    "X-Content-Type-Options": "nosniff",
    "X-Frame-Options": "DENY",
    "X-Permitted-Cross-Domain-Policies": "none"
  }
}

Per K. Jørgensen 0

We were expecting the headers to be set on the first response to "https://green-sea-07f102103-7937.westeurope.5.azurestaticapps.net/", but get following:

Header	Value
cache-control:	s-maxage=31536000, stale-while-revalidate
content-encoding:	br
content-type:	text/html; charset=utf-8
date:	Thu, 05 Sep 2024 10:30:57 GMT
request-context:	appId=cid-v1:
etag:	"pm920n3z6y3xg"request-context:
strict-transport-security:	max-age=31536000; includeSubDomains
vary:	RSC,Next-Router-State-Tree,Next-Router-Prefetch,Accept-Encoding,Accept-Encoding
x-ms-nextjs-render:	cache
x-nextjs-cache:	HIT
x-powered-by:	Next.js

The headers is set on the following responses for "js/css/ico/etc.." example:

Header	Value
cache-control:	public, must-revalidate, max-age=30
content-length:	46552
content-security-policy:	default-src 'self'
content-type:	font/woff2
date:	Thu, 05 Sep 2024 10:30:57 GMT
etag:	"62434256"-"f563ea2b5ba654a1eef86e02087dc02ae35eff54d90e66a9e85a59374ac90ac6"
last-modified:	Mon, 17 Jun 2024 13:32:03 GMT
referrer-policy:	strict-origin-when-cross-origin
strict-transport-security:	max-age=300; includeSubDomains; preload
x-content-type-options:	nosniff
x-dns-prefetch-control:	off
x-frame-options:	DENY
x-permitted-cross-domain-policies:	none
x-robots-tag:	none
x-xss-protection:	1; mode=block

Share via

Missing headers using Azure Static Web App with staticwebapp.config.json

Your answer