DEFAULT_RESPONSE_SECURITY_HEADERS

const DEFAULT_RESPONSE_SECURITY_HEADERS: Readonly<Record<string, string>>

Defined in: src/http/backend/HttpServerBackend.ts:55

Headers every shipped backend writes before a response’s own, so an explicit header from a handler still wins.

nosniff and nothing else. It is the one header of the helmet-style bundle that cannot change how an existing application is embedded, framed or referred to, so shipping it on by default breaks nobody while closing the MIME-sniffing hole in every response the framework writes (#127). X-Frame-Options, Cross-Origin-Resource-Policy and friends would break iframes, cross-origin embedding and OAuth popups, so they stay opt-in — newServerAt(…).withSecurityHeaders(…) for the whole server, or the securityHeaders() middleware for a route subtree.

This lives on the backend rather than in a middleware because a middleware only decorates responses that flow back through it: the backend’s own 404, its body-parse 413 and every error short-circuit never do. The backend is the single point every response passes.