servers.http.default-headers

default_headers

Configure default response headers for an HTTP or HTTPS server listener. Defaults apply to policy responses and early server-generated errors, including license and unavailable-policy errors.

servers {
    http "API" {
        listen { protocol tcp; addr "127.0.0.1:8080"; }
        clients "HTTP_CLIENTS";
        default_headers {
            "Cache-Control" "no-store";
            "X-Content-Type-Options" "nosniff";
        }
    }
}

Default: no additional response headers.

Each statement contains a header name and a configuration-time string value. Names are case-insensitive. Invalid names, values containing line breaks, and duplicate names are rejected during configuration compilation.

An existing response header takes precedence over the default, including values assigned through http.response_header.*. Defaults do not replace the content type chosen by the response builder.

Use populate_aaa_headers to control automatic X-AAA-* response headers.