Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Firebase hosting custom headers not working

I deploy a static site on firebase hosting with some header configuarations. But I some of my headers doesn't appear after the site deployed.

I tried change the value of Cache-Control header and it works. But X-Frame-Options,Content-Security-Policy,X-Content-Type-Options doesn't.

firebase.json:

{
    "hosting": {
        "public": "public",
        "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],
        "headers": [
            {
                "source": "**/*.@(html)",
                "headers": [
                    {
                        "key": "Cache-Control",
                        "value": "max-age=3600"
                    },
                        {
                        "key": "X-Frame-Options",
                        "value": "SAMEORIGIN"
                    },
                    {
                        "key": "Content-Security-Policy",
                        "value":
                            "script-src 'self' 'unsafe-inline' cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com"
                    }
                ]
            },
            {
                "source": "**/*.@(jpg|jpeg|gif|png|ico|svg)",
                "headers": [
                    {
                        "key": "Cache-Control",
                        "value": "max-age=2592000"
                    }
                ]
            },
            {
                "source": "**/*.@(js|css)",
                "headers": [
                    {
                        "key": "Cache-Control",
                        "value": "max-age=2592000"
                    }
                ]
            },
            {
                "source": "**/*",
                "headers": [
                    {
                        "key": "X-Content-Type-Options",
                        "value": "nosniff"
                    }
                ]
            }
        ]
    }
}

Actual response header I get:

actual response header

like image 276
3142 maple Avatar asked Jan 31 '26 07:01

3142 maple


1 Answers

After deploy, make sure to clear your browser's cache or use incognito mode. That's what happened to me, my custom headers were not showing because Chrome cached previously deployed version

like image 111
Vlad Soroka Avatar answered Feb 01 '26 22:02

Vlad Soroka