Documentation

Documentation / zerotal / index / SecureHeadersMiddleware

Class: SecureHeadersMiddleware

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:86

Adds common security response headers to every request.

Defaults provide a solid security baseline out of the box:

• X-Content-Type-Options: nosniff
• X-Frame-Options: SAMEORIGIN
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
• Strict-Transport-Security (only when secure: true)

Example

// Development (HTTP)
app.use([SecureHeadersMiddleware]);

// Production (HTTPS)
app.use([SecureHeadersMiddleware.with({ secure: true })]);

// Custom CSP
app.use([SecureHeadersMiddleware.with({
  secure: true,
  contentSecurityPolicy: "default-src 'self'; script-src 'self' 'nonce-{nonce}'",
})]);

Extends

• BaseMiddleware<SecureHeadersOptions>

Constructors

Constructor

new SecureHeadersMiddleware(): SecureHeadersMiddleware

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:88

Returns

SecureHeadersMiddleware

Overrides

BaseMiddleware.constructor

Properties

options

protected options: SecureHeadersOptions

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:87

Subclasses must declare this with their default option values. TypeScript enforces this at compile time — forgetting it is a type error.

Overrides

BaseMiddleware.options

Methods

with()

static with<T, Opts>(this, options): () => InstanceType<T>

Defined in: packages/core/src/middleware/BaseMiddleware.ts:48

Returns a zero-arg subclass with the given options deep-merged on top of the subclass defaults, usable directly in app.use([...]).

Type Parameters

T

T extends (...args) => BaseMiddleware<any>

Opts

Opts = T extends (...args) => BaseMiddleware<U> ? U : object

Parameters

this

T

options

Partial<Opts>

Returns

() => InstanceType<T>

Inherited from

BaseMiddleware.with

afterResponse()?

optional afterResponse(ctx): Promise<void>

Defined in: packages/core/src/middleware/BaseMiddleware.ts:70

Parameters

ctx

HttpContext

Returns

Promise<void>

Inherited from

BaseMiddleware.afterResponse

onError()?

optional onError(ctx, error): Promise<void>

Defined in: packages/core/src/middleware/BaseMiddleware.ts:71

Parameters

ctx

HttpContext

error

Error

Returns

Promise<void>

Inherited from

BaseMiddleware.onError

handle()

handle(_ctx, next): Promise<void | Response>

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:94

Parameters

_ctx

HttpContext

next

NextFn

Returns

Promise<void | Response>

Overrides

BaseMiddleware.handle