docs/customHttp.yml at main · aws-amplify/docs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# Custom headers when serving docs through Amplify Hosting
#
# See: https://docs.aws.amazon.com/amplify/latest/userguide/custom-headers.html#setting-custom-headers
customHeaders:
  - pattern: '**/*'
    headers:
      - key: 'Strict-Transport-Security'
        value: 'max-age=31536000; includeSubDomains'
      - key: 'X-Frame-Options'
        value: 'DENY'
      - key: 'X-XSS-Protection'
        value: '1; mode=block'
      - key: 'X-Content-Type-Options'
        value: 'nosniff'
      - key: 'Content-Security-Policy'
        value: 'upgrade-insecure-requests;'
      # CSP also set in _document.tsx meta tag
      # Link headers advertise agent-discovery resources (RFC 8288 / RFC 9727):
      # the API catalog, the agent skills index, the MCP server card, and the
      # LLM-friendly documentation index.
      #
      # Deliberately kept on the global block. Amplify header patterns are
      # positive-match only (no exclusion), and with trailingSlash: true the
      # actual page requests are extensionless directory URLs (e.g.
      # /react/build-a-backend/), so an `**/*.html` pattern would miss real
      # page loads and drop the header where agents need it most. The header
      # therefore also rides asset responses (a few extra bytes); the
      # missing-file risk this could have amplified is eliminated because the
      # generators now fail the build if a linked file is not written.
      - key: 'Link'
        value: '</.well-known/api-catalog>; rel="api-catalog", </.well-known/agent-skills/index.json>; rel="agent-skills"; type="application/json", </.well-known/mcp/server-card.json>; rel="mcp-server"; type="application/json", </ai/llms.txt>; rel="service-doc"; type="text/plain"'
  # Serve the API catalog as a linkset (RFC 9727 / RFC 9264) at both the
  # canonical extensionless path (served via a 200-rewrite in redirects.json)
  # and the underlying .json file.
  - pattern: '/.well-known/api-catalog'
    headers:
      - key: 'Content-Type'
        value: 'application/linkset+json'
  - pattern: '/.well-known/api-catalog.json'
    headers:
      - key: 'Content-Type'
        value: 'application/linkset+json'
  # Serve the generated agent-facing markdown twins as markdown so agents that
  # request them get the correct media type (these live under /ai/**).
  - pattern: '/ai/**/*.md'
    headers:
      - key: 'Content-Type'
        value: 'text/markdown; charset=utf-8'