interface SecurityHeadersOptions

Options for security headers middleware.

Properties

readonly
optional
enabled: boolean

Enable/disable all security headers. Defaults to true.

Content-Security-Policy configuration. Set to false to omit entirely. undefined keeps the default (no CSP by default since it breaks apps).

Strict-Transport-Security configuration. Set to false to omit. undefined uses defaults.

readonly
optional
xFrameOptions: string | false

X-Frame-Options value. Set to false to omit. undefined uses default (DENY).

readonly
optional
xContentTypeOptions: string | false

X-Content-Type-Options value. Set to false to omit. undefined uses default (nosniff).

readonly
optional
referrerPolicy: string | false

Referrer-Policy value. Set to false to omit. undefined uses default (no-referrer).

readonly
optional
permissionsPolicy: string | false

Permissions-Policy value. Set to false to omit. undefined uses default (none by default).

Usage

import { type SecurityHeadersOptions } from "http-security-plugin/src/index.ts";