Suitelet Response HTTP Header Restrictions
In addition to the headers outlined in the General Blocked HTTP Headers section, certain headers cannot be manually set when interacting with the http.ServerResponse objects sent by Suitelets. Attempting to set values for any of these headers will result in an SSS_INVALID_HEADER error. The restricted headers are listed below:
- Allow
- Content-Location
- Content-MD5
- Content-Range
- Date
- Location
- Proxy-Authenticate
- Public-Key-Pins
- Public-Key-Pins-Report-Only
- Retry-After
- Server
- Strict-Transport-Security
- Upgrade-Insecure-Requests
- Warning
- WWW-Authenticate