How do I add HTTP security headers to CloudFront responses?

Short description

HTTP security headers improve the privacy and security of a web application and protect it from vulnerabilities. See the following list for common HTTP security headers:

• Referrer Policy on the Mozilla website
• HTTP Strict Transport Security (HSTS) on the Mozilla website
• Content Security Policy (CSP) on the Mozilla website
• X-Content-Type-Options on the Mozilla website
• X-Frame-Options on the Mozilla website
• X-XSS-Protection on the Mozilla website

CloudFront response headers policies allow you to add one or more HTTP security headers to a response from CloudFront.

Resolution

You can use managed response headers policies that include pre-defined values for the most common HTTP security headers. Or, you can create a custom response header policy with custom security headers and values that you can add to the required CloudFront behavior.

Attach a response headers policy to a cache behavior

After you create a response headers policy, attach it to a cache behavior in a CloudFront distribution. To attach a managed or custom security headers response policy to an existing CloudFront distribution, complete the following steps:

1. Open the CloudFront console.
2. Choose the distribution that you want to update.
3. Under the Behaviors tab, select the cache behavior that you want to modify. Then, choose Edit.
4. For Response headers policy, choose SecurityHeadersPolicy. Or, choose the custom policy that you created.
5. Choose Save changes.

See the following example of a CloudFront response with HTTP security response headers:

curl -I https://dxxxxxxxbai33q.cloudfront.net
HTTP/2 200

content-type: text/html

content-length: 9850

vary: Accept-Encoding

date: xxxxxxxxx

last-modified: xxxxxxx

etag: "c59c5ef71f3350489xxxxxxxxxx"

x-amz-server-side-encryption: AES256

cache-control: no-store, no-cache, private

x-amz-version-id: null

accept-ranges: bytes

server: AmazonS3

x-xss-protection: 1; mode=block

x-frame-options: SAMEORIGIN

referrer-policy: strict-origin-when-cross-origin

x-content-type-options: nosniff

strict-transport-security: max-age=31536000

x-cache: Miss from cloudfront

via: 1.1 12142717248e0e7148a5c1a9151ab918.cloudfront.net (CloudFront)

x-amz-cf-pop: BOS50-C3

x-amz-cf-id: nHNANTZYdkQkE5BmsqlisPTiodFhVCK-Sf9Zp4iJzNs04eWi1_hEig==

Create a custom response headers policy from the CloudFront console

1. Open the CloudFront console.
2. From the navigation menu, choose Policies. Then, choose Response headers.
3. Choose Create response headers policy.
4. Under Security headers, select each of the security headers that you want to add to the policy. Add or select the required values for each header.
5. Under Custom headers, add the custom security headers and values that you want CloudFront to add to the responses.
6. Fill out other fields as required. Then, select Create.