# Configuring Custom Headers for Royal Server

**URL:** https://community.royalapps.com/t/configuring-custom-headers-for-royal-server/107
**Category:** Royal Server
**Tags:** documentation
**Created:** [March 13, 2024, 4:55pm UTC](https://community.royalapps.com/t/configuring-custom-headers-for-royal-server/107 "2024-03-13T16:55:16Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![system](https://community.royalapps.com/user_avatar/community.royalapps.com/system/32/244_2.png) [@system](https://community.royalapps.com/u/system)
#### Post date: [March 13, 2024, 4:55pm UTC](https://community.royalapps.com/t/configuring-custom-headers-for-royal-server/107/1 "2024-03-13T16:55:16Z")

</div>

Some Security Scanners require specific HTTP Headers to be present in the response of Royal Server.

Here are some headers with example values that can be configured:

- Strict-Transport-Security: nosniff
- X-Content-Type-Options: maxage:315360000
- Cache-Control: no-cache, no-store
- X-XSS-Protection: 1
- Content-Security-Policy: default-src

This can be achieved with the following configuration steps:

1. Make a backup of the configuration file at `%programdata%\RoyalServer\appsettings.json`
2. Edit the Royal Server configuration file at `%programdata%\RoyalServer\appsettings.json`
3. Look for the line

```json
 "CustomHeaders": [],

```

and **replace** this line with the following information:

```json
 "CustomHeaders": [
         {
             "Name": "X-Content-Type-Options",
             "Value": "nosniff",
             "Disabled": false
         },
         {
             "Name": "Strict-Transport-Security",
             "Value": "max-age=31536000",
             "Disabled": false
         },
                 {
             "Name": "Cache-Control",
             "Value": "no-cache, no-store",
             "Disabled": false
         },
         {
             "Name": "X-XSS-Protection",
             "Value": "1",
             "Disabled": false
         },
         {
             "Name": "Content-Security-Policy",
             "Value": "default-src",
             "Disabled": false
         }
     ],

```

After a restart of the Royal Server service, you can see the new headers sent back by Royal Server to the clients.

**Note:**

Some security scanner products require the Cache-Control to something like `private,max-age=31536000`.

For the request /authentication/signin (which is automatically redirected to if not logged in) [asp.net](http://asp.net) core resets to no-cache, no-store since this request must not be cached in any circumstances.

For details see this information from Microsoft:

[https://learn.microsoft.com/en-us/aspnet/core/performance/caching/middleware?view=aspnetcore-8.0#conditions-for-caching](https://learn.microsoft.com/en-us/aspnet/core/performance/caching/middleware?view=aspnetcore-8.0#conditions-for-caching)