Documentation / zerotal / index / SecureHeadersOptions

Interface: SecureHeadersOptions

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:12

Properties

contentSecurityPolicy?

optional contentSecurityPolicy?: string

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:17

Content-Security-Policy header value. Omitted by default — set this to a policy appropriate for your application.

hstsMaxAge?

optional hstsMaxAge?: number

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:24

Strict-Transport-Security max-age in seconds. Defaults to 1 year (31 536 000 s). Set to 0 to disable HSTS entirely. Only emitted when secure: true to avoid HSTS issues in plain-HTTP dev environments.

hstsIncludeSubDomains?

optional hstsIncludeSubDomains?: boolean

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:29

Include includeSubDomains in the HSTS header. Defaults to true.

hstsPreload?

optional hstsPreload?: boolean

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:35

Set the HSTS preload directive. Defaults to false. Only set this if you have registered the domain with the HSTS preload list.

secure?

optional secure?: boolean

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:41

Enable HSTS and the Secure flag on the XSRF-TOKEN cookie. Default false — set to true in production when serving over HTTPS.

frameOptions?

optional frameOptions?: false | "DENY" | "SAMEORIGIN"

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:47

X-Frame-Options value. Defaults to 'SAMEORIGIN'. Set to 'DENY' for maximum protection, or false to omit the header.

referrerPolicy?

optional referrerPolicy?: string

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:52

Referrer-Policy value. Defaults to 'strict-origin-when-cross-origin'.

permissionsPolicy?

optional permissionsPolicy?: string | false

Defined in: packages/core/src/middleware/SecureHeadersMiddleware.ts:58

Permissions-Policy header value. Defaults to a conservative policy disabling sensitive APIs.