Package software.amazon.awscdk.services.cloudfront

Interface ResponseSecurityHeadersBehavior

All Superinterfaces:
software.amazon.jsii.JsiiSerializable
All Known Implementing Classes:
ResponseSecurityHeadersBehavior.Jsii$Proxy
@Generated(value="jsii-pacmak/1.118.0 (build 02eec31)", date="2025-11-04T09:27:36.275Z") @Stability(Stable) public interface ResponseSecurityHeadersBehavior extends software.amazon.jsii.JsiiSerializable
Configuration for a set of security-related HTTP response headers.

CloudFront adds these headers to HTTP responses that it sends for requests that match a cache behavior associated with this response headers policy.

Example: 

 // Using an existing managed response headers policy
 S3Origin bucketOrigin;
 Distribution.Builder.create(this, "myDistManagedPolicy")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(bucketOrigin)
                 .responseHeadersPolicy(ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS)
                 .build())
         .build();
 // Creating a custom response headers policy -- all parameters optional
 ResponseHeadersPolicy myResponseHeadersPolicy = ResponseHeadersPolicy.Builder.create(this, "ResponseHeadersPolicy")
         .responseHeadersPolicyName("MyPolicy")
         .comment("A default policy")
         .corsBehavior(ResponseHeadersCorsBehavior.builder()
                 .accessControlAllowCredentials(false)
                 .accessControlAllowHeaders(List.of("X-Custom-Header-1", "X-Custom-Header-2"))
                 .accessControlAllowMethods(List.of("GET", "POST"))
                 .accessControlAllowOrigins(List.of("*"))
                 .accessControlExposeHeaders(List.of("X-Custom-Header-1", "X-Custom-Header-2"))
                 .accessControlMaxAge(Duration.seconds(600))
                 .originOverride(true)
                 .build())
         .customHeadersBehavior(ResponseCustomHeadersBehavior.builder()
                 .customHeaders(List.of(ResponseCustomHeader.builder().header("X-Amz-Date").value("some-value").override(true).build(), ResponseCustomHeader.builder().header("X-Amz-Security-Token").value("some-value").override(false).build()))
                 .build())
         .securityHeadersBehavior(ResponseSecurityHeadersBehavior.builder()
                 .contentSecurityPolicy(ResponseHeadersContentSecurityPolicy.builder().contentSecurityPolicy("default-src https:;").override(true).build())
                 .contentTypeOptions(ResponseHeadersContentTypeOptions.builder().override(true).build())
                 .frameOptions(ResponseHeadersFrameOptions.builder().frameOption(HeadersFrameOption.DENY).override(true).build())
                 .referrerPolicy(ResponseHeadersReferrerPolicy.builder().referrerPolicy(HeadersReferrerPolicy.NO_REFERRER).override(true).build())
                 .strictTransportSecurity(ResponseHeadersStrictTransportSecurity.builder().accessControlMaxAge(Duration.seconds(600)).includeSubdomains(true).override(true).build())
                 .xssProtection(ResponseHeadersXSSProtection.builder().protection(true).modeBlock(false).reportUri("https://example.com/csp-report").override(true).build())
                 .build())
         .removeHeaders(List.of("Server"))
         .serverTimingSamplingRate(50)
         .build();
 Distribution.Builder.create(this, "myDistCustomPolicy")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(bucketOrigin)
                 .responseHeadersPolicy(myResponseHeadersPolicy)
                 .build())
         .build();

  • Method Details

    • getContentSecurityPolicy

      @Stability(Stable) @Nullable default ResponseHeadersContentSecurityPolicy getContentSecurityPolicy()
      The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.

      Default: - no content security policy

    • getContentTypeOptions

      @Stability(Stable) @Nullable default ResponseHeadersContentTypeOptions getContentTypeOptions()
      Determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff.

      Default: - no content type options

    • getFrameOptions

      @Stability(Stable) @Nullable default ResponseHeadersFrameOptions getFrameOptions()
      Determines whether CloudFront includes the X-Frame-Options HTTP response header and the header’s value.

      Default: - no frame options

    • getReferrerPolicy

      @Stability(Stable) @Nullable default ResponseHeadersReferrerPolicy getReferrerPolicy()
      Determines whether CloudFront includes the Referrer-Policy HTTP response header and the header’s value.

      Default: - no referrer policy

    • getStrictTransportSecurity

      @Stability(Stable) @Nullable default ResponseHeadersStrictTransportSecurity getStrictTransportSecurity()
      Determines whether CloudFront includes the Strict-Transport-Security HTTP response header and the header’s value.

      Default: - no strict transport security

    • getXssProtection

      @Stability(Stable) @Nullable default ResponseHeadersXSSProtection getXssProtection()
      Determines whether CloudFront includes the X-XSS-Protection HTTP response header and the header’s value.

      Default: - no xss protection

    • builder

      @Stability(Stable) static ResponseSecurityHeadersBehavior.Builder builder()
      Returns:
      a ResponseSecurityHeadersBehavior.Builder of ResponseSecurityHeadersBehavior