HTTP Response Headers

Default settings

Thunder provides factory defaults for your single page application:

Security HeaderDefault Values
x-frame-optionsDENY
referrer-policystrict-origin-when-cross-origin
x-content-type-optionsnosniff
strict-transport-securitymax-age=31536000; includeSubDomains
Content-Security-Policydefault-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self' data:
X-XSS-Protection1; mode=block
CORS HeaderDefault Values
Access-Control-Allow-Origin*
Access-Control-Allow-Credentialsfalse
Access-Control-Allow-MethodsGET, HEAD, OPTIONS
Access-Control-Allow-Headers*
Access-Control-Max-Age600

Header Syntax

The header path must be a relative path without the domain. It will be matched with all custom domains attached to your site.

You can use wildcards to match arbitrary request paths.

PathEffect
/*Only the root directory paths.
/**All request paths, including the root path and all sub-paths
/blog/*Matches /blog/, /blog/latest-post/, and all other paths under /blog/
/**/*Matches /blog/, /assets/, and all other paths with at least two slashes.

Custom Response Headers

You can override the defaults and add custom headers with path patterns. Examples:

PathNameExample Value
/*Cache-Controlpublic, max-age=864000
/api/*Cache-Controlmax-age=0, no-cache, no-store, must-revalidate
/blog/*Cache-Controlpublic, max-age=31536000
/**Access-Control-Allow-Originhttps://www.foo.com
/**Referrer-Policysame-origin
/**Content-Typetext/html; charset=UTF-8