> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.itential.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server. # Understand HTTP headers in Itential Platform > Security enhancements to HTTP headers in Itential Platform This guide outlines various security enhancements to the HTTP headers in Itential Platform and why `httpOnly` was not set on all occurrences. ## Default HTTP response headers | Header | Syntax | Description | | ------------------------------ | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Access-Control-Allow-Origin` | `*` | Tells the browser to allow code from any origin to access a resource. See [Configurable headers](#configurable-headers). | | `Access-Control-Allow-Headers` | `Origin`, `X-Requested-With`, `Content-Type`, `Accept` | Used in response to a `preflight` request which includes the [Access-Control-Request-Headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers) to indicate which HTTP headers can be used during the actual request. | | `Access-Control-Allow-Methods` | `POST`, `GET`, `DELETE`, `OPTIONS` | Specifies the supported HTTP methods allowed when accessing the resource in response to a `preflight` request. | | `X-Frame-Options` | `SAMEORIGIN` | The page can only be displayed in a frame on the same origin as the page itself. | | `X-Content-Type-Options` | `nosniff` | A marker used by the server to indicate that the MIME types advertised in the [Content-Type](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type) headers should not be changed and be followed. | | `Strict-Transport-Security` | `max-age=31536000; includeSubDomains; preload` | This response header (HSTS) lets a web site tell browsers that it should only be accessed using HTTPS, instead of using HTTP. | ## Configurable headers The `Access-Control-Allow-Origin` header is configurable within an Itential Platform profile. It can be set within the `expressProps` under a [property](/itential-platform/2023-2/admin-essentials/profiles) called `access_control_allow_origin`. When this is set to a value different from the default of `*` it will also add `Origin` to the `Vary` header. ## Additional headers if cacheControl is turned on These are defined in the `expressProps` of the Profile document. | Header | Syntax | Description | | ------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `Cache-Control` | `Private`, `No-Cache`, `No-Store`, `Must-Revalidate` | Caching directives that can be used by the server in an HTTP response. | | `Pragma` | `No-Cache` | Used for backwards compatibility with HTTP/1.0 caches where the `Cache-Control` HTTP/1.1 header is not present. | | `Expires` | `0` | This header contains the date/time after which the response is considered stale. Invalid dates (the value 0) represent a date in the past and mean that the resource is already expired. | | `If-Modified-Since` | `Mon, 1 Jan 2014 01:00:00 GMT` | This request HTTP header makes the request conditional: the server will send back the requested resource, with a 200 status, only if it has been last modified after the given date. If the request has not been modified since, the response will be a 304. | ## Cookies The `Set-Cookie` HTTP response header is used to send cookies from the server to the user agent. Cookies are saved on login and tokens are used for sessions. | Value | Description | | ---------- | ----------------------------------------------------------------- | | `POST` | HTTP request call to `/login` sets the `httpOnly` flag to `true`. | | `httpOnly` | Cookies are not set for public, unauthenticated API calls. | | `secure` | Flag is set to `true` when Itential Platform is run over SSL. | ## HTTP verbs This constraint is effective beginning with **2023.2** and future releases. To support network security policies and provide an additional layer of control, Itential will not accept or process any **non-standard HTTP verbs** Itential Platform does not require for its operation. Further detail is described in the sections that follow. ### Always allowed HTTP verbs The following set of HTTP verbs will **always** be accepted in Itential Platform: `GET, POST, PUT, PATCH, HEAD, OPTIONS, DELETE` For any verbs not on this list, Itential has implemented a new property, `allowedHttpOptionalVerbs`, that will allow admins to specify an array of optional HTTP verbs Itential Platform can process. By default, non-permitted verbs are blocked from accessing the application. Consequently, Itential Platform will not process any server requests that contain restricted verbs and that are not defined ("turned on") in the `allowedHttpOptionalVerbs` property. ### Optional HTTP verbs As listed below, there are 26 optional HTTP verbs Itential admins can use. A 405 error ("Method Not Allowed") is returned if the server request uses a verb not on the list. These verbs must be in uppercase format. ```json "ACL", "BIND", "CHECKOUT", "CONNECT", "COPY", "LINK", "LOCK", "MERGE", "MKACTIVITY", "MKCALENDAR", "MKCOL", "MOVE", "M-SEARCH", "NOTIFY", "PROPFIND", "PROPPATCH", "PURGE", "REBIND", "REPORT", "SEARCH", "SUBSCRIBE", "TRACE", "UNBIND", "UNLINK", "UNLOCK", "UNSUBSCRIBE" ``` #### How to Configure Alternate HTTP Verbs To configure the HTTP verbs that can be used for inbound requests to the Itential Platform server, use `expressProps` in the active Itential Platform profile to configure the `allowedHttpOptionalVerbs` property. 1. Log in and navigate to Itential Platform → Administration → **Admin Essentials**. 2. Select the active profile under **Profiles**. 3. Click the **Configure** tab. 4. Select `expressProps` under **Edit Profile Properties**. 5. Update the `allowedHttpOptionalVerbs` property to include the desired verbs from the [allowed list](#optional-http-verbs-allowed) above. 6. Click **Save** to finalize your changes. 7. Restart Itential Platform.