--- schema_version: "1" id: 3bcb3286206499b4b21ad81feaf932b56182e9b602eadf5024012bc17d5de25c title: HTTP Response Headers collection: tableau version: next locale: en-gb portal_url: https://docs.salesforce.com/tableau/next/en-gb/server/security_http_headers.md canonical_url: https://help.tableau.com/v0.0/server/en-gb/security_http_headers.htm source_site: help.tableau.com content_type: documentation content_hash: f06a3abac240f3ea1f31d7b62c1b03fcfb7c71b6f133ba7ba99464ec137f9dab description: Configure HTTP response headers such as HSTS and Referrer-Policy on Tableau Server. --- [Skip to main content](#main-content) # HTTP Response Headers Tableau Server supports some of the response headers specified in the [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/#div-headers). This topic describes how to configure the following response headers for Tableau Server: - HTTP Strict Transport Security (HSTS) - Referrer-Policy - X-Content-Type-Options - X-XSS-Protection Tableau Server also supports the Content Security Policy (CSP) standard. CSP configuration is not covered in this topic. See [Content Security Policy](https://help.tableau.com/v0.0/server/en-gb/security_csp.htm). ## Configuring response headers All response headers are configured with the [tsm configuration set](https://help.tableau.com/v0.0/server/en-gb/cli_configuration_tsm.htm#TSMSet) command. When you are finished configuring response headers, run [tsm pending-changes apply](https://help.tableau.com/v0.0/server/en-gb/cli_pending-changes.htm#pending-changes-apply). If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case, there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behaviour. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server/en-gb/cli_pending-changes.htm#pending-changes-apply). ## HTTP Strict Transport Security (HSTS) HSTS forces clients connecting to Tableau Server to connect with HTTPS. For more information see the OWASP entry, [HTTP Strict Transport Security (HSTS)](https://owasp.org/www-project-secure-headers/#div-headers). ### Options gateway.http.hsts Default value: `false` The HTTP Strict Transport Security (HSTS) header forces browsers to use HTTPS on the domain where it is enabled. gateway.http.hsts\_options Default value: `"max-age=31536000"` By default, HSTS policy is set for one year (31536000 seconds). This time period specifies the amount of time in which the browser will access the server over HTTPS. ## Referrer-Policy Beginning in 2019.2, Tableau Server includes the ability to configure Referrer-Policy HTTP header behaviour. This policy is enabled with a default behaviour that will include the origin URL for all "secure as" connections (policy `no-referrer-when-downgrade`). In previous versions, the Referrer-Policy header was not included in responses sent by Tableau Server. For more information about the various policy options that Referrer-Policy supports, see the OWASP entry, [Referrer-Policy](https://owasp.org/www-project-secure-headers/#div-headers). ### Options gateway.http.referrer\_policy\_enabled Default value: `true` To exclude the Referrer-Policy header from responses sent by Tableau Server, set this value to `false`. gateway.http.referrer\_policy Default value: `no-referrer-when-downgrade` This option defines the referrer policy for Tableau Server. You may specify any of the policy value strings listed in the [Referrer-Policy](https://owasp.org/www-project-secure-headers/#div-headers) table on the OWASP page. ## X-Content-Type-Options The X-Content-Type-Options response HTTP header specifies that the MIME type in the Content-Type header should not be changed by the browser. In some cases, where MIME type is not specified, a browser may attempt to determine the MIME type by evaluating the characteristics of the payload. The browser will then display the content accordingly. This process is referred to as "sniffing". Misinterpreting the MIME type can lead to security vulnerabilities. For more information see the OWASP entry, [X-Content-Type-Options](https://owasp.org/www-project-secure-headers/#div-headers). ### Option gateway.http.x\_content\_type\_nosniff Default value: `true` The X-Content-Type-Options HTTP header is set to 'nosniff' by default with this option. ## X-XSS-Protection The HTTP X-XSS-Protection response header is sent to the browser to enable cross-site scripting (XSS) protection. The X-XSS-Protection response header overrides configurations in cases where users have disabled XXS protection in the browser. For more information see the OWASP entry, [X-XSS-Protection](https://owasp.org/www-project-secure-headers/#div-headers). ### Option gateway.http.x\_xss\_protection Default value: `true` The X-XSS-Protection response header is enabled by default with this option. ## Other articles in this section