skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

manage-headers

Inspects and configures HTTP security headers for Power Pages sites via site-setting YAML files.

808|167|Updated Jan 21, 2026
Search Tags:#security headers#clickjacking#YAML#content security policy#site settings#cORS#Power Pages
One-click install
npx skills add https://github.com/microsoft/power-platform-skills --skill manage-headers
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: manage-headers
Source: https://github.com/microsoft/power-platform-skills/tree/main/plugins/power-pages/skills/manage-headers
Command: npx skills add https://github.com/microsoft/power-platform-skills --skill manage-headers

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Power Pages sites omit security headers entirely unless they are explicitly configured as site settings, leaving sites exposed to clickjacking, cross-origin abuse, and misconfigured Content Security Policies that either break the site or provide no protection.

Core Features & Use Cases

  • Header inspection and gap analysis: Reads all HTTP/* site-setting YAML files in .powerpages-site/site-settings/, compares them against a recognized header catalogue, and identifies missing or misconfigured headers.
  • CSP composition and validation: Builds Content Security Policies from a starter template with the correct cloud-specific Power Pages runtime host, a per-request nonce, and external URLs discovered by scanning the project's source files.
  • Guided remediation: Presents each finding in plain language with accept, customize, or skip options, then applies changes by editing existing YAML files or creating new site settings, and offers deployment afterward.
  • Use Case: A developer asks "fix my CSP" after scripts are blocked on their Power Pages site; the skill inspects the current policy, adds the missing runtime host and project-specific external sources, and recommends report-only mode before enforcing.

Quick Start

Ask the assistant to review the security headers on my Power Pages site and fix any gaps it finds.

Frequently Asked Questions about manage-headers

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure security headers on a Power Pages site?▼

Security headers are configured as HTTP/* site settings, each stored as a separate YAML file in .powerpages-site/site-settings/. This skill inspects existing settings, identifies gaps against a recognized header catalogue, and creates or edits the YAML files, with changes taking effect after deployment.

How do I fix Content Security Policy errors on Power Pages?▼

The runtime emits the CSP value verbatim without adding runtime sources, so the policy must explicitly include the cloud-specific content.powerapps host and the 'nonce' keyword in script-src. The skill scans your project's source files for external URLs and composes a corrected policy, recommending report-only mode first.

Can I set HSTS or Cache-Control headers through Power Pages site settings?▼

No. Strict-Transport-Security and Cache-Control are platform-managed and cannot be overridden through site settings. Writing HTTP/Strict-Transport-Security has no effect because the runtime does not recognize it.

Why don't my configured headers show up in Power Pages Studio preview?▼

Maker-mode requests from Power Pages Studio skip all HTTP/* header emission, so configured headers never appear in the studio preview. Verify headers in an incognito browser tab or with curl -I against the site URL after deploying.

When should I avoid setting Cross-Origin-Resource-Policy to same-origin?▼

Avoid same-origin when the site hosts Azure AD B2C custom login pages, is embedded in cross-origin iframes, or serves resources to integrations like Power BI, since it breaks those flows. The safest default is leaving the header absent or using cross-origin.

Related Skills

Explore More Software Engineering Skills→
markus41markus41
12

Power Pages Development

Build external-facing Power Pages sites exposing Dataverse data via Liquid templates.

Community
Advanced
NewEarthAINewEarthAI

production-readiness-review

Drive a real browser over a live site and check the database for connection storm signatures.

Community
Advanced
ThrookieThrookie
2

springboot-security

Implement JWT/OAuth2 authentication, authorization, and secure configuration for Spring Boot services.

Community
Advanced
promitduttapromitdutta

create-webroles

Generate YAML files with UUIDs to create and verify Power Pages web roles.

Community
Advanced