Skip to documentation content

HTTP Response

On this page

    Methods that control redirects, headers, status codes, and CORS.

    {% redirect %}

    Redirects a "302 Found" HTTP response pointing to the location of the target. This is slower than using built-in redirects but is useful when other variables, processing, or conditionals need to be evaluated first.

    {% redirect target %}
    Parameters
    target requiredexpression
    Should resolve to a full-qualified URL (including the leading "https://", "http://", or "//") or to an entity with a URL May use liquid filters.
    Example Redirect the user to another URL or pageUse the redirect tag to send the user to another URL or page.

    Simple Use Case: Basic redirect

    Liquid
    {%- redirect '/thank-you' -%}

    Redirects the user to the given path or URL. The tag stops further rendering; use conditions (if/unless) when the redirect should be conditional, or Marketpath CMS redirects when the redirect is unconditional since they will perform better and do not require placeholder articles.

    Redirect to a page when permission is missing

    Liquid
    {%- if page.restrictiontype.is_valid and page.restrictionpage.is_valid -%}
	{%- var restrictiontype = page.restrictiontype.value -%}
	{%- unless permissions[restrictiontype].allowed -%}
		{%- redirect page.restrictionpage -%}
	{%- endunless -%}
{%- endif -%}

    Redirect to a restriction page when the user lacks the required permission.

    Redirect to a url with a constructed path (e.g. login with return URL)

    Liquid
    {%- if user.guest -%}
	{%- redirect request.path | url_encode | prepend: "/log-in?r=" -%}
{%- endif -%}

    Build a login URL that includes the current path as a return parameter.

    {% set_header %}

    Sets one or more headers in the HTTP response.

    {% set_header attributes %}
    Parameters
    attributes requireddictionary
    Key:value pairs with unique keys. May use the variable arguments syntax. The names and values of the headers to set in the HTTP response

    There are a number of reserved and invalid headers that may not be set using this method - mostly including headers with predefined meanings such as HTTP connection headers, CORS headers, and content and security headers. If you attempt to set an invalid or disallowed HTTP response header, it will simply be ignored rather than outputting an error message.

    Example How to use the set_header method

    Set a header to refresh

    Liquid
    {%- var customHeader = "do refresh in 5" -%}
{%- set_header Refresh:"5; url=https://www.example.com" X-Custom-Header:customHeader -%}

    This example demonstrates the use of the set_header method to set 2 headers to refresh the page in 5 seconds and include a custom header with a value.

    Set dynamic header by reference variable

    Liquid
    {%- var fieldname = 'Username' -%}
{%- var headername = fieldname | prepend: 'X-Custom-' -%}
{%- set_header &headername:session[fieldname] -%}

    This example dynamically defines a header name based on the value of a fieldname variable, and then sets the header to the value of the matching session variable.

    {% set_content_type %}

    Sets the Content-Type header for the HTTP response.

    {% set_content_type value %}
    Parameters
    value requiredexpression
    Example Set the HTTP response content typeSet the HTTP response Content-Type header (e.g. application/json, text/html) with set_content_type.
    Liquid
    {% set_content_type "application/xml" %}
    Output
    application/xml
    Liquid
    {%- var contenttype = "text/csv" -%}
{%- set_content_type contenttype -%}
    Output
    text/csv
    Liquid
    {%- var contenttype = "csv" -%}
{%- set_content_type "text/" | append: contenttype -%}
    Output
    text/csv

    {% set_response_code %}

    Sets the HTTP response status code.

    {% set_response_code code %}
    Parameters
    code requiredinteger
    Must be a number between 100 and 599. May not be a variable or other expression that evaluates to a number
    Example Set HTTP response code to 418 (I'm a teapot)Use set_response_code to return a custom HTTP status (e.g. 418) with an optional message.
    Liquid
    {%- var objectType = "teapot" -%}
{%- set_response_code 418 objectType | prepend: "I'm a " -%}
    Example How to use the {% set_response_code %} methodUse set_response_code to return a 404 (Not Found) status when a resource is missing, or a custom status like 418 with an optional message.

    Set HTTP 404 (Not Found)

    Liquid
    {% set_response_code 404 %}

    Set HTTP 418 (I'm a teapot) with message

    Liquid
    {%- var objectType = "teapot" -%}
{%- set_response_code 418 objectType | prepend: "I'm a " -%}

    {% allow_cors %}

    Enables CORS headers on the response.

    {% allow_cors always? %}
    Parameters
    always optionalbool
    Specifies that the CORS headers should be sent for all origins

    If the "always" keyword is specified, CORS will be enabled for all origins. Otherwise it will only be enabled for the current origin (ie: {{ request.headers.origin }}).

    Example How to allow cross-origin requestsUse the allow_cors tag to allow cross-origin requests either from all origins, from a specific domain, or based on custom logic.

    From all origins

    Liquid
    {% allow_cors always %}

    Allow requests from any origin.

    From a specific domain

    Liquid
    {%- if request.headers.origin == 'https://specifically-allowed-domain.com' -%}
	{%- allow_cors -%}
{%- endif -%}

    Allow CORS only when the request Origin header matches a specific domain.

    Based on custom logic

    Liquid
    {%- set is_authorized = false -%}
{%- comment %}custom logic for authorizing the current request{% endcomment -%}
{%- if is_authorized -%}
	{%- allow_cors -%}
{%- endif -%}

    Allow CORS only when your authorization logic permits.