Response headers: who wins

headers in dusk.config.ts is a list of rules. For a header name that a route or the handler also sets:

• by default the route's header wins and the rule only fills in what is absent;
• override: true makes the rule win (Next's headers() behavior).

headers: [
  { source: "/api/*path", headers: { "cache-control": "no-store" }, override: true },
],

Between rules, the last matching rule decides a name's value and its override flag. The framework's secure defaults (security.headers) always come last and fill only what is absent.

The cache-control of a response that sets none is private, no-store. security.defaultCacheControl replaces that default: a string, or false for no header at all. A route rule's cacheControl replaces it for the rule's paths. So the order is the route's own header or a headers rule, then the route rule's cacheControl, then security.defaultCacheControl. Entity tags (a 304 for a matching If-None-Match, and the generated weak ETag of a buffered page) are described in Entity tags and conditional requests.

// dusk.config.ts
export default defineConfig({
  security: { defaultCacheControl: "private, no-cache" },
  routeRules: {
    "/static/*path": { cacheControl: "public, max-age=31536000, immutable" },
    "/health": { cacheControl: false },
  },
});