Can I customize HTTP security headers (HSTS, CSP, etc.) on FusionAuth Cloud?

[FASupportBot]

I'm running a security scan against our FusionAuth Cloud tenant and found several HTTP security header issues:

• Strict-Transport-Security is present but has max-age=300 (5 minutes), which is far below the 1-year minimum (31536000 seconds) required for HSTS preload to take effect
• Content-Security-Policy header is not being sent
• X-Content-Type-Options header is not being sent
• Referrer-Policy header is not being sent

Is there a way to configure or customize these security headers for a FusionAuth Cloud tenant? Ideally I'd like to set Strict-Transport-Security: max-age=31536000; includeSubDomains; preload and add the missing security headers.

[FASupportBot]

At this time, FusionAuth Cloud does not support customizing HTTP security headers on individual tenant deployments. There is an existing GitHub feature request tracking this capability, but it is not currently on the roadmap and no ETA is available for when this might be added.

If you are running a self-hosted FusionAuth instance, you can configure these headers using a reverse proxy (nginx, Apache, etc.) in front of FusionAuth. For FusionAuth Cloud customers, this configuration is managed at the infrastructure level and cannot be modified per-tenant.

You may want to subscribe to or comment on the relevant GitHub issue to track progress on this feature request.