Azure / Azure/azure-functions-host

Add Response Headers to default Azure Function 4.0 UI Page

Open
#11,095 2 comments 0 reactions 0 assignees View on GitHub
enhancement Needs: Triage (Functions)
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

### Description

Hello,

can you please add option to add security Headers:

**X-Content-Type-Options**: This HTTP header will prevent the browser from interpreting files as a different MIME type to what is specified in the Content-Type HTTP header.

**Strict-Transport-Security**: The HTTP Strict-Transport-Security response header (HSTS) allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol.

to the default UI page of Function app worker

Internal scans are reporting it, and I was not able to find any way how to add response headers myself.

Thank you

![Image](https://github.com/user-attachments/assets/37501fc8-fa5a-4954-9ea9-a9699562d6c3)

Contributor guide

Open the contributing guide

Research direction

No source files or tests are identified in the issue. Start by locating the default Azure Function 4.0 UI page and its response-generation entry point, then determine how response headers are currently set. Done means the page response includes X-Content-Type-Options and Strict-Transport-Security, with tests or verification covering both headers.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.