Examples

Example 1

import { HttpSecurityPlugin, corsMiddleware } from '@setu-ts/http-security-plugin';

app.register(HttpSecurityPlugin({
  cors: { origin: 'https://example.com', credentials: true },
  csrf: { trustedOrigins: ['https://example.com'] },
}));

// Per-route use of standalone factories:
app.router.get('/api', {
  middleware: [corsMiddleware({ origin: 'https://other.com' })],
  handler: (ctx) => ctx.response.json({ ok: true }),
});

Functions

Interfaces

I
ContentSecurityPolicyOptions

Options for Content-Security-Policy header.

I
CorsOptions

Options for CORS middleware.

I
CsrfOptions

Options for CSRF middleware.

  • customHeader: string

    When set, unsafe methods must carry this custom header or the request is rejected with 403. Simple form submits cannot set custom headers without a preflight, making this a CSRF defense.

  • enabled: boolean

    Enable/disable CSRF protection. Defaults to true when present.

  • trustedOrigins: readonly string[]

    Additional trusted origins (scheme+host) beyond the request's own origin. The request's own origin (derived from request.url) is always implicitly trusted. Default: [].

I
HttpSecurityPluginOptions

Options for HttpSecurityPlugin.

I
IpSecurityOptions

Options for IP security middleware.

  • enabled: boolean

    Enable/disable IP resolution. Defaults to true when present.

  • ipHeader: string

    The header name to read when trustProxy is true. Default: X-Forwarded-For.

  • proxyHops: number

    The number of proxies in front of this application, when they cannot be addressed by IP (a managed load balancer on a rotating address). The nth entry FROM THE RIGHT is the client: 1 skips the immediate peer's contribution, 2 skips two, and so on.

  • trustProxy: boolean

    When true, read the client IP from the proxy header instead of request.ip. Requires a trusted reverse proxy. Default: false.

  • trustedProxies: readonly string[]

    Addresses of the proxies in front of this application, as literal addresses or CIDR blocks. When supplied, the header is walked RIGHT to LEFT and the first entry that is not one of these is the client.

I
RequestSizeOptions

Options for request-size middleware.

I
SecurityHeadersOptions

Options for security headers middleware.

I
StrictTransportSecurityOptions

Options for Strict-Transport-Security header.

Type Aliases

Usage

import * as HTTP_transport_security_plugin__CORS__security_headers__CSRF__request_size__IP_security__Middleware_only_plugin_with_no_capability_token_or_service__ from "http-security-plugin/src/index.ts";