# ResponseHeadersCorsBehavior

Configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).

CloudFront adds these headers to HTTP responses that it sends for CORS requests that match a cache behavior
associated with this response headers policy.

- Source: [`aws-cloudfront/lib/response-headers-policy.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-cloudfront/lib/response-headers-policy.ts#L240)
- Type last changed: v2.1.0 · 8 Dec 2021

## Example

```ts
// Using an existing managed response headers policy
declare const bucketOrigin: origins.S3Origin;
new cloudfront.Distribution(this, 'myDistManagedPolicy', {
  defaultBehavior: {
    origin: bucketOrigin,
    responseHeadersPolicy: cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS,
  },
});

// Creating a custom response headers policy -- all parameters optional
const myResponseHeadersPolicy = new cloudfront.ResponseHeadersPolicy(this, 'ResponseHeadersPolicy', {
  responseHeadersPolicyName: 'MyPolicy',
  comment: 'A default policy',
  corsBehavior: {
    accessControlAllowCredentials: false,
    accessControlAllowHeaders: ['X-Custom-Header-1', 'X-Custom-Header-2'],
    accessControlAllowMethods: ['GET', 'POST'],
    accessControlAllowOrigins: ['*'],
    accessControlExposeHeaders: ['X-Custom-Header-1', 'X-Custom-Header-2'],
    accessControlMaxAge: Duration.seconds(600),
    originOverride: true,
  },
  customHeadersBehavior: {
    customHeaders: [
      { header: 'X-Amz-Date', value: 'some-value', override: true },
      { header: 'X-Amz-Security-Token', value: 'some-value', override: false },
    ],
  },
  securityHeadersBehavior: {
    contentSecurityPolicy: { contentSecurityPolicy: 'default-src https:;', override: true },
    contentTypeOptions: { override: true },
    frameOptions: { frameOption: cloudfront.HeadersFrameOption.DENY, override: true },
    referrerPolicy: { referrerPolicy: cloudfront.HeadersReferrerPolicy.NO_REFERRER, override: true },
    strictTransportSecurity: { accessControlMaxAge: Duration.seconds(600), includeSubdomains: true, override: true },
    xssProtection: { protection: true, modeBlock: false, reportUri: 'https://example.com/csp-report', override: true },
  },
  removeHeaders: ['Server'],
  serverTimingSamplingRate: 50,
});
new cloudfront.Distribution(this, 'myDistCustomPolicy', {
  defaultBehavior: {
    origin: bucketOrigin,
    responseHeadersPolicy: myResponseHeadersPolicy,
  },
});
```

## Properties

- `accessControlAllowCredentials`: boolean (required) — A Boolean that CloudFront uses as the value for the Access-Control-Allow-Credentials HTTP response header.

- `accessControlAllowHeaders`: string[] (required) — A list of HTTP header names that CloudFront includes as values for the Access-Control-Allow-Headers HTTP response header.

  You can specify `['*']` to allow all headers.

- `accessControlAllowMethods`: string[] (required) — A list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header.

  Allowed methods: `'GET'`, `'DELETE'`, `'HEAD'`, `'OPTIONS'`, `'PATCH'`, `'POST'`, and `'PUT'`.
  You can specify `['ALL']` to allow all methods.

- `accessControlAllowOrigins`: string[] (required) — A list of origins (domain names) that CloudFront can use as the value for the Access-Control-Allow-Origin HTTP response header.

  You can specify `['*']` to allow all origins.

- `accessControlExposeHeaders`: string[] — A list of HTTP headers that CloudFront includes as values for the Access-Control-Expose-Headers HTTP response header.

  **Default:** no headers exposed

  You can specify `['*']` to expose all headers.

- `accessControlMaxAge`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) — A number that CloudFront uses as the value for the Access-Control-Max-Age HTTP response header.

  **Default:** no max age

- `originOverride`: boolean (required) — A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.