{
    "description": {
        "description": "Metadata description",
        "message": "Disallow certain HTTP response headers"
    },
    "disallowedHeaders": {
        "description": "Report message when the response includes multiple disallowed headers",
        "message": "Response should not include disallowed headers: $1"
    },
    "headerValueShouldOnlyContain": {
        "description": "Report message when the 'server' header contains more than the server name",
        "message": "The 'server' header should only contain the server name."
    },
    "disallowedExpiresHeader": {
        "description": "Report message when the response includes the Expires header",
        "message": "The 'Expires' header should not be used, 'Cache-Control' should be preferred."
    },
    "disallowedHostHeader": {
        "description": "Report message when the response includes the Host header",
        "message": "The 'Host' header should not be used, it is a request header only."
    },
    "disallowedP3PHeader": {
        "description": "Report message when the response includes the P3P header",
        "message": "The 'P3P' header should not be used, it is a non-standard header only implemented in Internet Explorer."
    },
    "disallowedPragmaHeader": {
        "description": "Report message when the response includes the Pragma header",
        "message": "The 'Pragma' header should not be used, it is deprecated and is a request header only."
    },
    "disallowedXFrameOptionsHeader": {
        "description": "Report message when the response includes the X-Frame-Options header",
        "message": "The 'X-Frame-Options' header should not be used. A similar effect, with more consistent support and stronger checks, can be achieved with the 'Content-Security-Policy' header and 'frame-ancestors' directive."
    },
    "name": {
        "description": "Metadata name",
        "message": "Disallowed HTTP headers"
    }
}