## 4.1.4.2.2.4  Routing Configuration File
The routing configuration defined in the xs-app.json file contains the properties used by the application router.
The following example of an xs-app.json application descriptor shows the JSON-compliant syntax required and the properties that either must be set or can be specified as an additional option.
```
 Code Syntax { "welcomeFile": "index.html", "authenticationMethod": "route", "sessionTimeout": 10, "pluginMetadataEndpoint": "/metadata", "routes": [ { "source": "^/sap/ui5/1(.*)$", "target": "$1", "destination": "ui5", "csrfProtection": false }, { "source": "/employeeData/(.*)", "target": "/services/employeeService/$1",
```
```
"destination": "employeeServices", "authenticationType": "xsuaa", "scope": ["$XSAPPNAME.viewer", "$XSAPPNAME.writer"], "csrfProtection": true }, { "source": "^/(.*)$", "target": "/web/$1", "localDir": "static-content", "replace": { "pathSuffixes": ["/abc/index.html"], "vars": ["NAME"] }, { "source": "^/user-api(.*)", "target": "$1", "service": "sap-approuter-userapi" } } ], "login": { "callbackEndpoint": "/custom/login/callback" }, "logout": { "logoutEndpoint": "/my/logout", "logoutPage": "/logout-page.html" }, "destinations": { "employeeServices": { "logoutPath": "/services/employeeService/logout", "logoutMethod": "GET" } }, "responseHeaders" : [ {"name": "Content-Security-Policy", "value": "default-src 'self'"} ], "compression": { "minSize": 2048 }, "whitelistService": { "endpoint": "/whitelist/service" }, "websockets": { "enabled": true }, "errorPage": [ {"status": [400,401,402], "file": "/custom-err-4xx.html"}, {"status": 501, "file": "/custom-err-501.html"} ] }
```
The following table lists the properties that either must be set or can be specified as an additional option. Click on the links for information for each property:
| Property                        | Type   | Description                                                                                                     |
|---------------------------------|--------|-----------------------------------------------------------------------------------------------------------------|
| welcomeFile [page 453]          | String | The Web page served by default if the HTTP request does not include a spe- cific path, for example, index.html. |
| authenticationMethod [page 454] | String | The method used to authenticate user requests, for example: 'route' or 'none' (no authentication).              |
| Property                   | Type   | Description                                                                                                                                                    |
|----------------------------|--------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| sessionTimeout [page 454]  | Number | Define the amount of time (in minutes) for which a session can remain inactive before it closes automatically (times out); the default time out is 15 minutes. |
| routes [page 455]          | Array  | Defines all route objects, for ex- ample: source , target , and, destination .                                                                                 |
| login [page 468]           | Object | A redirect to the application router at a specific endpoint takes place during OAuth2 authentication with the User Account and Authentication service (UAA).   |
| logout [page 468]          | Object | You can define any options that apply if you want your application to have cen- tral log out end point.                                                        |
| destinations [page 472]    | Object | Specify any additional options for your destinations.                                                                                                          |
| services [page 473]        | Object | Specify options for a service in your ap- plication.                                                                                                           |
| responseHeaders [page 474] | Array  | Add custom response headers to your application.                                                                                                               |
| compression [page 475]     | Object | The compression keyword enables you to define if the application router compresses text resources before sending them.                                         |
| Property                          | Type   | Description                                                                                                                                                        |
|-----------------------------------|--------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| pluginMetadataEndpoint [page 476] | String | Adds an endpoint that serves a JSON string representing all configured plu- gins.                                                                                  |
| whitelistService [page 476]       | Object | Enable the allowlist service to help pre- venting click-jacking attacks.                                                                                           |
| websockets [page 478]             | Object | The application router can forward web- socket communication. Web-socket communication must be enabled in the application router configuration.                    |
| errorPage [page 478]              | Array  | Errors originating in the application router show the HTTP status code of the error. It is possible to display a cus- tom error page using the errorPage property. |
## Related Information
Application Router [page 439] Application Router Configuration [page 444]