Skip to main content

HTTP Response Headers

Files.com uses HTTP response headers to control how browsers load content, display pages, and use HTTPS. The applicable policy depends on the response: an interactive page, an API response, and an embedded Share Link serve different purposes. Evaluate the headers on the URL involved in your integration or review.

Content Security Policy

The web interface's Content-Security-Policy separates the sources permitted for scripts, styles, images, embedded frames, and network connections. Each directive governs a particular type of content. For example, script-src-elem controls script elements when present; otherwise, the browser falls back to script-src and then default-src, following the CSP directive rulesExternal LinkThis link leads to an external website and will open in a new tab.

Files.com permits inline styles through unsafe-inline in style-src to support custom branding. That permission applies to styling, not JavaScript. The appearance of unsafe-inline in a style directive does not establish that inline scripts are permitted.

Embedded Content

Files.com provides dedicated embedded versions of Share Links and Inboxes for use on other websites. An ordinary Files.com page and its embedded version are not interchangeable when evaluating framing restrictions.

The parent's frame-src policy controls which frames it can load. The embedded page's frame-ancestors policy controls which pages may contain it. These are different checksExternal LinkThis link leads to an external website and will open in a new tab, so review the response being embedded as well as the containing website's policy. Content Security Policy for Embedding covers the configuration your website needs.

HTTPS and Custom Domains

Files.com enables HTTP Strict Transport Security (HSTS) on its Custom Subdomains. The Strict-Transport-Security header tells browsers to use HTTPS for subsequent connections to that hostname.

For a Custom Domain, HSTS depends on the site's Custom Domain setting. Review the hostname and its configuration when checking for this header.

API Response Content

Files.com API responses use a restrictive Content Security Policy because they return data rather than an interactive page. They also use X-Content-Type-Options: nosniff, which tells browsers to honor the declared content type rather than infer a different one. These browser controls complement the API's authentication and permission checks; they do not grant access to files or change a user's permissions.