How do you add a custom HTTP response header in Rails?

In rails 5, the following solution works (in action methods)

response.set_header("Header-Name", "Header value")

Reference: edgeapi

In Rails 3 or above, simply

headers['Header-Name'] = 'header value'

works in controllers. This is even the recommended way; according to the documentation,

Response is mostly a Ruby on Rails framework implementation detail, and should never be used directly in controllers. Controllers should use the methods defined in ActionController::Base instead. For example, if you want to set the HTTP response’s content MIME type, then use ActionController::Base#headers instead of Response#headers.

And this is still true in Rails 7.0.

In rails 4, set the response headers in the application.rb or respective environment files. Once you done that, you can override the header value wherever you required in the controller. Refer this url for more details.

If your headers are static, e.g. your own custom Server header, you can simply update config.action_dispatch.default_headers. The following example sets a custom Server header; add it to your config/application.rb or config/environments/...:

config.action_dispatch.default_headers["Server"] = "MyServer/#{config.version}"

(Assuming you set config.version earlier)

For more, see Rails Guides: Configuring Rails Applications: Configuring Action Dispatch:

config.action_dispatch.default_headers is a hash with HTTP headers that are set by default in each response.

This will be less work each request than running a controller callback.

NB: For more than one header use merge! to not remove existing essential XSS etc headers.

In rails 4 works following:

class API::V1::BaseController 
  after_action :set_version_header

  protected
    def set_version_header
        response.headers['X-ComanyName-Api-Version'] = 'V1'
    end
end

How to set a response header, BaseCamp style:

• Use a before_action

• And use a concern. Basically a glorified mixin.

class ApplicationController < ActionController::Base
  include Authentication, Authorization, VersionHeaders

  # Only allow modern browsers supporting webp images, web push, badges, import maps, CSS nesting, and CSS :has.
  allow_browser versions: :modern
end

# But let's look at the VersionHeaders module
# so all of that is set in a before_action 

module VersionHeaders
  extend ActiveSupport::Concern

  included do
    before_action :set_version_headers
  end

  private
    def set_version_headers
      response.headers["X-Version"] = Rails.application.config.app_version
      response.headers["X-Rev"] = Rails.application.config.git_revision
    end
end

## Boom - that's where the response headers are set.
## Not sure why anyone would care about the git_revision though.
## Would love someone to explain that to me.
## This is an excerpt from the WriteBook code base. Shamelessly copied without permission here. But I'm 100000% sure the base camp guys would not care, and would rather commend me for contributing to the learning of Rails / ruby.
# My thanks to them for providing me the source code from which I can learn.