11

I need to add response headers like X-Frame, Cache-control, Pragma etc directly into the html code, may be, using attributes in html elements?

It is for help pages which are directly coming from a directory via href link.

Is there any way to add headers to these htmls?

Pramod
  • 768
  • 1
  • 12
  • 27
  • 1
    Possible duplicate of [Custom HTTP Request headers in HTML](http://stackoverflow.com/questions/3047711/custom-http-request-headers-in-html) – Ross Mar 22 '16 at 16:14

3 Answers3

10

You can use meta to replicate some of these. Normally not the ideal solution, but look into the http-equiv attribute of meta tags. I believe a lot of these have been deprecated in newer browsers.

Examples:

<meta http-equiv="Cache-control" content="no-cache"/>

<meta http-equiv="X-Frame-Options" content="sameorigin"/>

<meta http-equiv="pragma" content="no-cache"/>
hopkins-matt
  • 2,763
  • 2
  • 15
  • 23
  • OWASP disagrees with this answer: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#common-defense-mistakes – vlasits Mar 24 '23 at 21:57
  • Sadly you can't do this for all of the HTTP headers, only a few, see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#http-equiv – MarcellPerger Mar 31 '23 at 21:20
8

In short: no, you cannot. HTML files are the body of an HTTP response; the headers must come from the server. Anything you could embed in the HTML file would just become part of the body.

Ross Presser
  • 6,027
  • 1
  • 34
  • 66
1

You can add something like this, if php execution is enabled on your web server:

<?php
http_response_code(your_response_code)
?>
rest-of-your-html-code

This will execute a php script that will set the response code.

Gabor Szita
  • 319
  • 4
  • 13