CODEWITHSUNDEEP
http-headersmulelistenermulesoftmule4
Jason Lee
Jason Lee

Reputation: 43

Mule 4 - Unable to override some of the values of HTTP Response headers

I am facing difficulties in overriding the list of HTTP Response headers listed below

  1. X-Content-Type-Options (from 1 to nosniff)

  2. X-Frame-Options (from SAMEORIGIN to deny)

  3. Set-Cookie (add HttpOnly;Secure)

I have tried to put these values into the Listener's HTTP Response headers as well as utilizing the Header Removal and Header Injection in the API Manager policies but to no success in overriding to the intended values.

May I know how do override the HTTP Response headers? Kindly refer to the photo of the values that I have set.

API Policies

API policies

Header Removal

Header Removal

Header Injection

Header Injection

Listener's response header values in the mule project

listener header

Response header from the API call

response

Upvotes: 0

Views: 1564

Answers (2)

Lei Zhao
Lei Zhao

Reputation: 141

These headers "X-Content-Type-Options", "X-Frame-Options" are injected by DLB, so not able to remove or modify at Mule app or policy level, unless not using DLB. MuleSoft has fixed it and should be available in their next release.

Upvotes: 1

AndrWeisR
AndrWeisR

Reputation: 1226

In the API Manager policies, use the Inbound Header Map instead of the Outbound Header Map for both header removal and injection.

Upvotes: 0

Related Questions