HTTP headers are the meta-data that is returned alongside the request responses from your project. On Servd, there are a few ways to configure them:
Via the Servd Dashboard
You can configure the headers returned by your project environments via the Servd dashboard.
Headers are configured on a per-environment basis, allowing you to test specific configurations in staging before copying those same settings over to production.
Visit your staging, development and production headers pages.
In the table, add your headers. They are formed from three elements:
From Path: a pattern which is checked against the incoming URL path (the part after the domain, excluding query params). If this pattern matches the header is added.
Header Key: the key of the header e.g. `X-Frame-Options`
Header Value: the value of the header e.g. `SAMEORIGIN`
Click the "Add Another" button to add more rows for additional headers.
Click the "Save" button.
Sync your project.
The From Path pattern is evaluated as regex. The full scope of regex is too large to discuss here, but you can learn more here and try some examples here.
Via Twig
It's also possible to add headers in your templates via Craft's `header` twig tag, which looks something like:
{% header "X-Frame-Options: SAMEORIGIN" %}
Strict Transport Security Header
Servd tightly controls the `Strict-Transport-Security` header. It can't currently be edited via Twig or our dashboard because Servd manages projects' SSL certificates, so needs to be able to control the flow of HTTP vs. HTTPS traffic.
Browsers cache STS header values for a long time depending on the `max-age` value of the header, particularly if the `preload` directive is included. Increasing it should be done with great care, and only should be done if the project does not make use of unsecured HTTP traffic.
If you would like to configure the value of the STS header for your project, and you fully understand the potential issues, please get in contact with [email protected] with all domains you would like it configured for. Supported values currently include:
`max-age=63072000; includeSubDomains; preload` - cache for 2 years, enforce HTTPS for all subdomains, instruct browsers to hard code the value until the expiry.
`max-age=31536000; includeSubDomains; preload` - cache for 1 year, enforce HTTPS for all subdomains, instruct browsers to hard code the value until the expiry.
`max-age=15552000` - cache for 6 months.