# Format of \`services.ports.http\_options.response.headers\` in \`fly.toml\`

**URL:** <https://community.fly.io/t/format-of-services-ports-http-options-response-headers-in-fly-toml/8124>\
**Category:** Questions / Help\
**Created:** [October 24, 2022, 7:30pm UTC](https://community.fly.io/t/format-of-services-ports-http-options-response-headers-in-fly-toml/8124 "2022-10-24T19:30:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![salimb](https://avatars.discourse-cdn.com/v4/letter/s/c89c15/32.png) [@salimb](https://community.fly.io/u/salimb)\
**Post date:** [October 24, 2022, 7:30pm UTC](https://community.fly.io/t/format-of-services-ports-http-options-response-headers-in-fly-toml/8124/1 "2022-10-24T19:30:45Z")

</div>

Today I tried adding various HTTP response headers to a Fly app via setting the **`services.ports.http_options.response.headers`** option [as described here](https://community.fly.io/t/new-feature-basic-http-response-header-modification/3594).

Instead of using a TOML [inline table](https://toml.io/en/v1.0.0#inline-table), I defined it as follows for better readability:

```ini
[[services.ports]]
port = 443
handlers = ["tls", "http"]

[services.ports.http_options.response.headers]
Content-Security-Policy = "default-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'"
Referrer-Policy = "strict-origin-when-cross-origin"
Strict-Transport-Security = "max-age=63072000; includeSubDomains"
X-Content-Type-Options = "nosniff"
X-Frame-Options = "DENY"

```

The above works fine.

But when I define the `Content-Security-Policy` key as a [multi-line literal string](https://toml.io/en/v1.0.0#string) instead of a normal string (again, for better readability), …

```ini
Content-Security-Policy = '''
  default-src 'self';
  base-uri 'self';
  form-action 'none';
  frame-ancestors 'none
'''

```

…no CSP header is returned anymore after deployment, so there must be some Fly-internal parsing error / incompatibility somewhere.

Defining HTTP response headers with exactly the same syntax (multi-line literal strings that contain semantically irrelevant whitespace) works fine with [Netlify](https://docs.netlify.com/routing/headers/#syntax-for-the-netlify-configuration-file) (with the `netlify.toml` config file to be precise).

Why does Fly fail to process such strings?

---

<div class="post-metadata">

**Author:** ![gskierk](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/gskierk/32/39428_2.png) [@gskierk](https://community.fly.io/u/gskierk)\
**Post date:** [January 15, 2025, 12:33pm UTC](https://community.fly.io/t/format-of-services-ports-http-options-response-headers-in-fly-toml/8124/2 "2025-01-15T12:33:12Z")

</div>

It would be great to make it possible.