{"result":{"depiction_url":null,"edges":{"references":{"objects":[{"created":"2020-05-30T05:48:23Z","object_id":{"id":1274,"is_a":["text","documentation","developerguide"],"name":"doc_developerguide_notifications","title":{"_type":"trans","tr":{"en":"Respond to a notification"}},"uri":"https:\/\/zotonic.com\/id\/1274"},"seq":1000000}],"predicate":{"id":332,"is_a":["meta","predicate"],"name":"references","title":{"_type":"trans","tr":{"en":"References"}},"uri":"https:\/\/zotonic.com\/id\/references"}},"subject":{"objects":[{"created":"2026-09-09T13:47:36Z","object_id":{"id":2555,"is_a":["categorization","keyword","keyword_information_type"],"name":"zotonic_topic_reference","title":"Reference","uri":"https:\/\/zotonic.com\/id\/2555"},"seq":1},{"created":"2026-09-09T13:47:36Z","object_id":{"id":2564,"is_a":["categorization","keyword","keyword_audience"],"name":"zotonic_topic_backend_developer","title":"Backend developer","uri":"https:\/\/zotonic.com\/id\/2564"},"seq":2},{"created":"2026-09-09T13:47:36Z","object_id":{"id":2627,"is_a":["categorization","keyword","keyword_architecture"],"name":"zotonic_topic_notification","title":"Notification","uri":"https:\/\/zotonic.com\/id\/2627"},"seq":3},{"created":"2026-09-09T13:47:36Z","object_id":{"id":2676,"is_a":["categorization","keyword","keyword_technology"],"name":"zotonic_topic_http","title":"HTTP","uri":"https:\/\/zotonic.com\/id\/2676"},"seq":4},{"created":"2026-09-09T13:47:36Z","object_id":{"id":2685,"is_a":["categorization","keyword","keyword_quality"],"name":"zotonic_topic_security","title":"Security","uri":"https:\/\/zotonic.com\/id\/2685"},"seq":5}],"predicate":{"id":308,"is_a":["meta","predicate"],"name":"subject","title":{"_type":"trans","tr":{"en":"Keyword"}},"uri":"http:\/\/purl.org\/dc\/elements\/1.1\/subject"}}},"id":2161,"is_a":["text","documentation","reference","notification"],"links":[{"rel":"self","target":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/2161"},{"rel":"hub","target":"https:\/\/zotonic.com\/.zotonic\/websub"}],"medium":null,"medium_url":null,"name":"doc_notification_security_headers","page_url":{"en":"https:\/\/zotonic.com\/docs\/2161\/observe_security_headers-2","x-default":"https:\/\/zotonic.com\/docs\/2161\/observe_security_headers-2"},"preview_url":null,"resource":{"version":4045,"pivot_location_lat":null,"title":"observe_security_headers\/2","is_authoritative":true,"body":"<p>Check and possibly modify the http response security headers All headers are in lowercase.<\/p>\n<p>Type:<\/p>\n<p><a href=\"\/id\/doc_developerguide_notifications#notification-first\">first<\/a><\/p>\n<p>Return:<\/p>\n<p><code>#security_headers{}<\/code> properties:<\/p>\n<ul><li>headers: <code>list<\/code><\/li><\/ul>\n<p>This is called when the <em>security headers<\/em> are set for the request, which is done at the start of the request handling,\nbefore any controller callback is called.<\/p>\n<p>That is done so early to ensure that any returned payload has all required security headers.<\/p>\n<p>The default security header list is:<\/p>\n<pre class=\"notranslate\"><code class=\"notranslate language-erlang\">[\n    % Content-Security-Policy is not added by default\n    % {&lt;&lt;&quot;content-security-policy&quot;&gt;&gt;, &lt;&lt;&quot;script-src &#39;self&#39; &#39;nonce-&#39;&quot;&gt;&gt;}\n    {&lt;&lt;&quot;x-xss-protection&quot;&gt;&gt;, &lt;&lt;&quot;1&quot;&gt;&gt;},\n    {&lt;&lt;&quot;x-content-type-options&quot;&gt;&gt;, &lt;&lt;&quot;nosniff&quot;&gt;&gt;},\n    {&lt;&lt;&quot;x-permitted-cross-domain-policies&quot;&gt;&gt;, &lt;&lt;&quot;none&quot;&gt;&gt;},\n    {&lt;&lt;&quot;referrer-policy&quot;&gt;&gt;, &lt;&lt;&quot;same-origin&quot;&gt;&gt;},\n    {&lt;&lt;&quot;x-frame-options&quot;&gt;&gt;, &lt;&lt;&quot;SAMEORIGIN&quot;&gt;&gt;}\n]\n<\/code><\/pre>\n<p>If the controller option <code>allow_frame<\/code> is set to true then the <code>x-frame-options<\/code> header is not added.<\/p>\n<p>The <code>security_headers<\/code> notification does a <em>first<\/em> to fetch the security headers. The default headers are passed in the\n<code>headers<\/code> field of the notification.<\/p>\n<p>If the notification returns a list with <code>&lt;&lt;&quot;content-security-policy&quot;&gt;&gt;<\/code> then in the value of the\nContent-Security-Policy header the string <code>&#39;nonce-&#39;<\/code> is replaced with the unique nonce for the request.<\/p>\n<p>The nonce can de added to script tags:<\/p>\n<pre class=\"notranslate\"><code class=\"notranslate language-django\">&lt;script type=&quot;text\/javascript&quot; nonce=&quot;{{ m.req.csp_nonce }}&quot;&gt;\n    \/\/ Inline javascript here\n&lt;\/script&gt;\n<\/code><\/pre>\n<p>It can be requested in Erlang code using:<\/p>\n<pre class=\"notranslate\"><code class=\"notranslate language-erlang\">CSPNonce = z_context:csp_nonce(Context).\n<\/code><\/pre>\n<p>Or via the <code>m_req<\/code> model:<\/p>\n<pre class=\"notranslate\"><code class=\"notranslate language-erlang\">CSPNonce = m_req:get(csp_nonce, Context).\n<\/code><\/pre>\n<p>Note that the nonce is only set iff the Context is a HTTP request context. It is <em>not<\/em> set for MQTT contexts.<\/p>","slug":"observe_security_headers-2","is_protected":false,"visible_for":0,"tz":"UTC","language":["en"],"doc_source_hash":"b5ecb387f6f005ace6414cc99d5811120a10dc3bf11f725840b5174232585b13","is_featured":false,"notification":{"arity":2,"callbacks":[{"arity":2,"name":"observe_security_headers","signature":"observe_security_headers\/2","variation":"observe"}],"name":"security_headers","record":{"headers":"undefined"}},"content_group_id":{"id":2551,"is_a":["meta","content_group"],"name":"content_group_imported_docs","title":"Imported documentation","uri":"https:\/\/zotonic.com\/id\/content_group_imported_docs"},"category_id":{"id":1122,"is_a":["meta","category"],"name":"notification","title":"Notifications","uri":"https:\/\/test.zotonic.com\/id\/1122"},"doc_source_path":"apps\/zotonic_core\/src\/behaviours\/zotonic_observer.erl","publication_start":"2023-06-24T08:17:58Z","github_url":"https:\/\/github.com\/zotonic\/zotonic\/blob\/master\/apps\/zotonic_core\/src\/behaviours\/zotonic_observer.erl","pivot_location_lng":null,"doc_source_kind":"notification","name":"doc_notification_security_headers","is_unfindable":false,"is_published":true,"pivot_geocode":null,"created":"2020-05-30T05:48:11Z","uri":null,"doc_status":"current","is_dependent":false,"publication_end":"9999-06-01T00:00:00Z","modifier_id":{"id":1,"is_a":["person"],"name":"administrator","title":"Site Administrator","uri":"https:\/\/zotonic.com\/id\/1"},"privacy":0,"doc_source_commit":"28493fb676b2d92727e68d4fba20d89c56cf8ead\n","creator_id":{"id":336,"is_a":["person","robot"],"name":"gitbot","title":"Git","uri":"https:\/\/zotonic.com\/id\/336"},"modified":"2026-10-15T20:07:16Z","title_slug":"observe_security_headers-2"},"uri":"https:\/\/zotonic.com\/id\/2161","uri_template":"https:\/\/zotonic.com\/id\/:id","websub":{"hub":"https:\/\/zotonic.com\/.zotonic\/websub","topic":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/2161"}},"status":"ok"}