Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

In my Cloudfront distribution, under behavior section, add security header doesn't work

0

Within the settings of my Cloudfront distribution, edit behavior, I enabled "Response headers policy - optional" and set it to "Managed-CORS-with-preflight-and-SecurityHeadersPolicy" which allows all origins for CORS requests, including preflight requests, and adds security headers, including Strict-Transport-Security, set to max-age: 31536000 (seconds). However, upon testing, my browser indicates there is no security header detected, and it failed HSTS test. Upon further testing, it appears that there the header is empty.

  • jliu
    2 years ago

    I use multiple CDNs for my website. I indicate different host values (IP address for the domain name of my website) to test out different CDNs. Cloudflare's CDN is fine with HSTS, but as soon as I designate IP to Amazon Cloudfront servers, the HSTS and all security headers are missing.

Topics
Security, Identity, & ComplianceNetworking & Content DeliveryAWS Well-Architected Framework
Tags
Amazon CloudFrontSecurity, Identity, & ComplianceSecurity
Language
English
asked 2 years ago1K views
1 Answer
2
Accepted Answer

Are you sure you are hitting the same behavior for which you configured the response header policy?

Perhaps you could try opening the developer tools (F12) in Chrome or other Chromium-based browser, opening the Network tab, enabling the "Disable cache" and "Preserve logs" options, and loading the site again. Find the request for the page or component that is triggering the error (which might also be specifically identified in an error message in the Console view of the developer tools), and check in its "response headers" properties that the response is actually coming from CloudFront and that the headers are really missing, rather than, for example, your origin specifiying different values that are taking precedence over the defaults in the response header policy.

If your origin is specifying conflicting values for the headers, you can create a custom response header policy that explicitly overrides the headers received from the origin.

EXPERT
answered 2 years ago
EXPERT
reviewed a year ago
EXPERT
reviewed 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content