Configuring Custom Security Headers in Constellation

User Experience Knowledge Share
1

In traditional Pega applications, we rely on the Dynamic System Setting (DSS) Pega-RulesEngine/http/responseHeaders to append custom security headers (like X-XSS-Protection) to standard, servlet-based HTTP traffic.

However, if you are migrating to or building on Constellation, you will notice that this traditional DSS is completely bypassed.

The Architectural Shift

Constellation operates on a stateless, API-driven model powered entirely by the DX API layer. Because the DX API is built on top of Pega’s REST services framework, standard servlet header configurations do not apply.

The Solution

To inject custom security headers into your Constellation application, you must target the underlying Service REST layer instead. You can achieve this by using the following DSS:

  • Owning Ruleset: Pega-RulesEngine

  • Purpose: http/servicerestresponseHeaders

Important Consideration

Defining your custom headers here will successfully apply them to all your Constellation network responses. However, please note that this is a global setting—it will append these headers to all inbound Service REST responses across your environment, not just the DX API endpoints.

Please find the details about this setting in Pega Documentation.

Setting:

image
image762Ă—265 9.28 KB

API Response in Network Tab of Browser:

image
image880Ă—301 7.09 KB

3 Likes
2

In Pega Constellation apps, the standard DSS setting for adding custom security headers does not work, because Constellation runs on the DX API, which uses REST services instead of regular servlets. To fix this, create a Dynamic System Setting with owning ruleset “Pega-RulesEngine” and purpose “http/servicerestresponseHeaders”. This correctly applies headers like X-XSS-Protection to Constellation’s responses. Keep in mind this setting is global, so it will add these headers to all Service REST responses in your system, not just Constellation’s.