configuring-tauri-http-headers

Set headers under app.security.headers in src-tauri/tauri.conf.json using string, array, or object values. Only headers on Tauri's allowlist are supported, and the feature requires Tauri v2.1.0 or later.

SharedArrayBuffer requires cross-origin isolation: set Cross-Origin-Opener-Policy to same-origin and Cross-Origin-Embedder-Policy to require-corp together in app.security.headers. Both headers must be present for it to work.

Headers in tauri.conf.json only apply to production builds, not dev servers. Configure equivalent headers in your framework's dev server, such as the server.headers option in vite.config.ts.

Tauri restricts configuration to an allowlist covering CORS headers, Cross-Origin-Opener/Embedder/Resource-Policy, X-Content-Type-Options, Permissions-Policy, Timing-Allow-Origin, and Service-Worker-Allowed. Content-Security-Policy is configured separately under app.security.csp.

Add the required Access-Control headers such as Access-Control-Allow-Methods and Access-Control-Allow-Headers in app.security.headers. Use Access-Control-Expose-Headers to make custom response headers visible to the webview.