Response headers

On every response

By host

Subdomains of rt.ht and custom domains differ in three headers.

Pages

The root document of a route, served at route/. It answers GET only.

Your h:* attributes do not apply to the root document.

Exported files

A file exported with o:, served at route/name for any method.

Worker responses

What your worker returns for a /: URL or a fallback request.

The pages in Error pages and status codes carry no edge-worker header.

Compression

Text, JavaScript, JSON, XML, SVG, font and WebAssembly responses are compressed with zstd, Brotli or gzip, and carry vary: accept-encoding. text/markdown is not on the list, so Markdown files are sent uncompressed.

In the playground

The playground output serves your exports with its own rules, so headers you set with h: behave differently while you edit.

Your other h:* headers are sent in the playground too.

Notes

Platform headers win

You cannot change server-actual or server-vendor, and on *.rt.ht you cannot change strict-transport-security or referrer-policy. An h:edge or h:deploy attribute is combined with the platform's value instead of replacing it.

Content types

The extensions below have a type of their own. Others, such as .webmanifest, .map, .yaml, .toml, .vtt and .jsx, are not in the table, so set their type with o:type.

The .ts row is not a typo: the table types the extension as MPEG transport streams, so set o:type on exported TypeScript files.

HTML exports and the doctype

An exported page is a text/html text body that does not start with <!doctype html. Every response for such a page carries Vary: Sec-Fetch-Dest. A navigation (Sec-Fetch-Dest is document, frame, iframe, embed, object or fencedframe) receives <!doctype html> in front of the page, and its content-length grows to match. A fetch() receives the page as it is, without the doctype. Exported pages get no generated social tags. text/html has no charset, so start each page with <meta charset=utf-8>, or set o:type="text/html;charset=utf-8".

CORS

Pages allow any origin. For a file, add h:access-control-allow-origin=*. A worker sets the CORS headers of its own responses and answers its own preflight requests.

Looking at headers

Use GET to see the headers of a page, because the root document does not answer HEAD. Exported files answer any method.

curl -s -D - -o /dev/null https://name.rt.ht/
curl -sI https://name.rt.ht/.css

Setting headers on a file

On RTEdge.net, /.css answers text/css with cache-control: public, max-age=300, and /data.json answers application/json with access-control-allow-origin: *. In the playground the cache header is replaced by no-store, as the table above says.

<style o:=.css h:cache-control="public, max-age=300">
  body { font: 1rem/1.5 system-ui; color-scheme: light dark }
</style>
<script o:=data.json type=application/json h:access-control-allow-origin=*>
  {"hello": "world"}
</script>
<p><a href=data.json>data.json</a> and <a href=.css>.css</a></p>

See also

• h:*
• o:type
• Exporting files with o:
• Error pages and status codes
• Anatomy of a deployment
• ?::/h: