Modify First Party Response

This feature executes on vcl_deliver only for first party requests (Sensor, CAPTCHA, XHR).

You can use it to edit response headers, like CORS or other security features.

The code in vcl_deliver after px_deliver is still executed even if this feature is implemented.

EXAMPLE 1

By default, HUMAN returns ’*’ for the Access-Control-Allow-Origin header on first party responses.

TO overwrite this behavior:

1. Open the PX_CUSTOM.vcl file.
2. Uncomment the unset resp.http.Access-Control-Allow-Origin line:

1
sub px_custom_first_party_response_modifier {
2
  unset resp.http.Access-Control-Allow-Origin;
3
}

EXAMPLE 2

You can tell browsers that only HTTPS is allowed.

TO implement:

1. Open the PX_CUSTOM.vcl file.
2. Uncomment the set resp.http.Strict-Transport-Security = “max-age=86400” line:

1
sub px_custom_first_party_response_modifier {
2
  set resp.http.Strict-Transport-Security = "max-age=86400";
3
}