Optional ReadonlycorsCORS configuration. Presence enables CORS; absent means inactive.
Optional ReadonlycsrfCSRF configuration. Presence enables CSRF; absent means inactive.
Optional ReadonlyheadersSecurity headers configuration. Omitted → default secure header set.
{ enabled: false } → off. Sub-fields override individual headers.
Optional ReadonlyipIP security configuration. Presence enables IP resolution; absent means inactive.
Optional ReadonlyrequestRequest-size configuration. Presence enables size limiting; absent means inactive.
Options for HttpSecurityPlugin.