ResponseHeadersContentTypeOptions Struct
Determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff.
Example
ts
// Using an existing managed response headers policy
declare const bucketOrigin: origins.S3Origin;
new cloudfront.Distribution(this, 'myDistManagedPolicy', {
defaultBehavior: {
origin: bucketOrigin,
responseHeadersPolicy: cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS,
},
});
// Creating a custom response headers policy -- all parameters optional
const myResponseHeadersPolicy = new cloudfront.ResponseHeadersPolicy(this, 'ResponseHeadersPolicy', {
responseHeadersPolicyName: 'MyPolicy',
comment: 'A default policy',
corsBehavior: {
accessControlAllowCredentials: false,
accessControlAllowHeaders: ['X-Custom-Header-1', 'X-Custom-Header-2'],
accessControlAllowMethods: ['GET', 'POST'],
accessControlAllowOrigins: ['*'],
accessControlExposeHeaders: ['X-Custom-Header-1', 'X-Custom-Header-2'],
accessControlMaxAge: Duration.seconds(600),
originOverride: true,
},
customHeadersBehavior: {
customHeaders: [
{ header: 'X-Amz-Date', value: 'some-value', override: true },
{ header: 'X-Amz-Security-Token', value: 'some-value', override: false },
],
},
securityHeadersBehavior: {
contentSecurityPolicy: { contentSecurityPolicy: 'default-src https:;', override: true },
contentTypeOptions: { override: true },
frameOptions: { frameOption: cloudfront.HeadersFrameOption.DENY, override: true },
referrerPolicy: { referrerPolicy: cloudfront.HeadersReferrerPolicy.NO_REFERRER, override: true },
strictTransportSecurity: { accessControlMaxAge: Duration.seconds(600), includeSubdomains: true, override: true },
xssProtection: { protection: true, modeBlock: false, reportUri: 'https://example.com/csp-report', override: true },
},
removeHeaders: ['Server'],
serverTimingSamplingRate: 50,
});
new cloudfront.Distribution(this, 'myDistCustomPolicy', {
defaultBehavior: {
origin: bucketOrigin,
responseHeadersPolicy: myResponseHeadersPolicy,
},
});
python
# Using an existing managed response headers policy
# bucket_origin: origins.S3Origin
cloudfront.Distribution(self, "myDistManagedPolicy",
default_behavior=cloudfront.BehaviorOptions(
origin=bucket_origin,
response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
)
)
# Creating a custom response headers policy -- all parameters optional
my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
response_headers_policy_name="MyPolicy",
comment="A default policy",
cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
access_control_allow_credentials=False,
access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
access_control_allow_methods=["GET", "POST"],
access_control_allow_origins=["*"],
access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
access_control_max_age=Duration.seconds(600),
origin_override=True
),
custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
]
),
security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=False, report_uri="https://example.com/csp-report", override=True)
),
remove_headers=["Server"],
server_timing_sampling_rate=50
)
cloudfront.Distribution(self, "myDistCustomPolicy",
default_behavior=cloudfront.BehaviorOptions(
origin=bucket_origin,
response_headers_policy=my_response_headers_policy
)
)
java
// Using an existing managed response headers policy
S3Origin bucketOrigin;
Distribution.Builder.create(this, "myDistManagedPolicy")
.defaultBehavior(BehaviorOptions.builder()
.origin(bucketOrigin)
.responseHeadersPolicy(ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS)
.build())
.build();
// Creating a custom response headers policy -- all parameters optional
ResponseHeadersPolicy myResponseHeadersPolicy = ResponseHeadersPolicy.Builder.create(this, "ResponseHeadersPolicy")
.responseHeadersPolicyName("MyPolicy")
.comment("A default policy")
.corsBehavior(ResponseHeadersCorsBehavior.builder()
.accessControlAllowCredentials(false)
.accessControlAllowHeaders(List.of("X-Custom-Header-1", "X-Custom-Header-2"))
.accessControlAllowMethods(List.of("GET", "POST"))
.accessControlAllowOrigins(List.of("*"))
.accessControlExposeHeaders(List.of("X-Custom-Header-1", "X-Custom-Header-2"))
.accessControlMaxAge(Duration.seconds(600))
.originOverride(true)
.build())
.customHeadersBehavior(ResponseCustomHeadersBehavior.builder()
.customHeaders(List.of(ResponseCustomHeader.builder().header("X-Amz-Date").value("some-value").override(true).build(), ResponseCustomHeader.builder().header("X-Amz-Security-Token").value("some-value").override(false).build()))
.build())
.securityHeadersBehavior(ResponseSecurityHeadersBehavior.builder()
.contentSecurityPolicy(ResponseHeadersContentSecurityPolicy.builder().contentSecurityPolicy("default-src https:;").override(true).build())
.contentTypeOptions(ResponseHeadersContentTypeOptions.builder().override(true).build())
.frameOptions(ResponseHeadersFrameOptions.builder().frameOption(HeadersFrameOption.DENY).override(true).build())
.referrerPolicy(ResponseHeadersReferrerPolicy.builder().referrerPolicy(HeadersReferrerPolicy.NO_REFERRER).override(true).build())
.strictTransportSecurity(ResponseHeadersStrictTransportSecurity.builder().accessControlMaxAge(Duration.seconds(600)).includeSubdomains(true).override(true).build())
.xssProtection(ResponseHeadersXSSProtection.builder().protection(true).modeBlock(false).reportUri("https://example.com/csp-report").override(true).build())
.build())
.removeHeaders(List.of("Server"))
.serverTimingSamplingRate(50)
.build();
Distribution.Builder.create(this, "myDistCustomPolicy")
.defaultBehavior(BehaviorOptions.builder()
.origin(bucketOrigin)
.responseHeadersPolicy(myResponseHeadersPolicy)
.build())
.build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
// Using an existing managed response headers policy
S3Origin bucketOrigin;
new Distribution(this, "myDistManagedPolicy", new DistributionProps {
DefaultBehavior = new BehaviorOptions {
Origin = bucketOrigin,
ResponseHeadersPolicy = ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
}
});
// Creating a custom response headers policy -- all parameters optional
var myResponseHeadersPolicy = new ResponseHeadersPolicy(this, "ResponseHeadersPolicy", new ResponseHeadersPolicyProps {
ResponseHeadersPolicyName = "MyPolicy",
Comment = "A default policy",
CorsBehavior = new ResponseHeadersCorsBehavior {
AccessControlAllowCredentials = false,
AccessControlAllowHeaders = new [] { "X-Custom-Header-1", "X-Custom-Header-2" },
AccessControlAllowMethods = new [] { "GET", "POST" },
AccessControlAllowOrigins = new [] { "*" },
AccessControlExposeHeaders = new [] { "X-Custom-Header-1", "X-Custom-Header-2" },
AccessControlMaxAge = Duration.Seconds(600),
OriginOverride = true
},
CustomHeadersBehavior = new ResponseCustomHeadersBehavior {
CustomHeaders = new [] { new ResponseCustomHeader { Header = "X-Amz-Date", Value = "some-value", Override = true }, new ResponseCustomHeader { Header = "X-Amz-Security-Token", Value = "some-value", Override = false } }
},
SecurityHeadersBehavior = new ResponseSecurityHeadersBehavior {
ContentSecurityPolicy = new ResponseHeadersContentSecurityPolicy { ContentSecurityPolicy = "default-src https:;", Override = true },
ContentTypeOptions = new ResponseHeadersContentTypeOptions { Override = true },
FrameOptions = new ResponseHeadersFrameOptions { FrameOption = HeadersFrameOption.DENY, Override = true },
ReferrerPolicy = new ResponseHeadersReferrerPolicy { ReferrerPolicy = HeadersReferrerPolicy.NO_REFERRER, Override = true },
StrictTransportSecurity = new ResponseHeadersStrictTransportSecurity { AccessControlMaxAge = Duration.Seconds(600), IncludeSubdomains = true, Override = true },
XssProtection = new ResponseHeadersXSSProtection { Protection = true, ModeBlock = false, ReportUri = "https://example.com/csp-report", Override = true }
},
RemoveHeaders = new [] { "Server" },
ServerTimingSamplingRate = 50
});
new Distribution(this, "myDistCustomPolicy", new DistributionProps {
DefaultBehavior = new BehaviorOptions {
Origin = bucketOrigin,
ResponseHeadersPolicy = myResponseHeadersPolicy
}
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
// Using an existing managed response headers policy
var bucketOrigin S3Origin
cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &DistributionProps{
DefaultBehavior: &BehaviorOptions{
Origin: bucketOrigin,
ResponseHeadersPolicy: cloudfront.ResponseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
},
})
// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &ResponseHeadersPolicyProps{
ResponseHeadersPolicyName: jsii.String("MyPolicy"),
Comment: jsii.String("A default policy"),
CorsBehavior: &ResponseHeadersCorsBehavior{
AccessControlAllowCredentials: jsii.Boolean(false),
AccessControlAllowHeaders: []*string{
jsii.String("X-Custom-Header-1"),
jsii.String("X-Custom-Header-2"),
},
AccessControlAllowMethods: []*string{
jsii.String("GET"),
jsii.String("POST"),
},
AccessControlAllowOrigins: []*string{
jsii.String("*"),
},
AccessControlExposeHeaders: []*string{
jsii.String("X-Custom-Header-1"),
jsii.String("X-Custom-Header-2"),
},
AccessControlMaxAge: awscdk.Duration_Seconds(jsii.Number(600)),
OriginOverride: jsii.Boolean(true),
},
CustomHeadersBehavior: &ResponseCustomHeadersBehavior{
CustomHeaders: []ResponseCustomHeader{
&ResponseCustomHeader{
Header: jsii.String("X-Amz-Date"),
Value: jsii.String("some-value"),
Override: jsii.Boolean(true),
},
&ResponseCustomHeader{
Header: jsii.String("X-Amz-Security-Token"),
Value: jsii.String("some-value"),
Override: jsii.Boolean(false),
},
},
},
SecurityHeadersBehavior: &ResponseSecurityHeadersBehavior{
ContentSecurityPolicy: &ResponseHeadersContentSecurityPolicy{
ContentSecurityPolicy: jsii.String("default-src https:;"),
Override: jsii.Boolean(true),
},
ContentTypeOptions: &ResponseHeadersContentTypeOptions{
Override: jsii.Boolean(true),
},
FrameOptions: &ResponseHeadersFrameOptions{
FrameOption: cloudfront.HeadersFrameOption_DENY,
Override: jsii.Boolean(true),
},
ReferrerPolicy: &ResponseHeadersReferrerPolicy{
ReferrerPolicy: cloudfront.HeadersReferrerPolicy_NO_REFERRER,
Override: jsii.Boolean(true),
},
StrictTransportSecurity: &ResponseHeadersStrictTransportSecurity{
AccessControlMaxAge: awscdk.Duration_*Seconds(jsii.Number(600)),
IncludeSubdomains: jsii.Boolean(true),
Override: jsii.Boolean(true),
},
XssProtection: &ResponseHeadersXSSProtection{
Protection: jsii.Boolean(true),
ModeBlock: jsii.Boolean(false),
ReportUri: jsii.String("https://example.com/csp-report"),
Override: jsii.Boolean(true),
},
},
RemoveHeaders: []*string{
jsii.String("Server"),
},
ServerTimingSamplingRate: jsii.Number(50),
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &DistributionProps{
DefaultBehavior: &BehaviorOptions{
Origin: bucketOrigin,
ResponseHeadersPolicy: myResponseHeadersPolicy,
},
})
Properties
A Boolean that determines whether CloudFront overrides the X-Content-Type-Options HTTP response header received from the origin with the one specified in this response headers policy.