Response headers

Add, override or remove headers on the response, and set CORS or cookies.

Type	responseHeaders
Category	Transform

Fields

Field	Type	Required	Default	Description
setHeaders	key/value map	no	—	Set on the response. An empty value removes a header your app sent.
cacheControl	text	no	—	Value for the Cache-Control response header, e.g. no-store.
cacheStatuses	list of numbers	no	—	Cacheable statuses. Example: 200.
cors	group	no	—	CORS.
setCookies	list of groups	no	—	Set cookies.

cors

Field	Type	Required	Default	Description
enabled	true/false	no	—	Enabled.
origins	list of text	no	—	Cannot be * when credentials are allowed. Example: https://example.com.
allowMethods	list of text	no	—	Allowed methods. Example: GET.
allowedHeaders	list of text	no	—	Allowed headers. Example: Content-Type.
exposeHeaders	list of text	no	—	Exposed headers. Example: X-Request-Id.
allowCredentials	true/false	no	—	Allow credentials.
maxAge	number	no	—	Preflight cache lifetime in seconds.

setCookies

A list; each entry has these fields.

Field	Type	Required	Default	Description
name	text	yes	—	Name.
value	text	no	—	Value.
attributes	group	no	—	Attributes.

setCookies.attributes

Field	Type	Required	Default	Description
path	text	no	—	Path.
domain	text	no	—	Domain.
maxAge	number	no	—	0 = session, -1 = delete, >0 = persistent.
secure	true/false	no	—	Secure.
httpOnly	true/false	no	—	HttpOnly.
sameSite	one of Strict, Lax, None	no	—	SameSite.