SecurityHeadersOptionsType

SecurityHeadersOptionsType = object

Defined in: src/http/middleware/SecurityHeadersOptions.ts:15

Plain settings shape for the security-headers bundle.

Properties

contentTypeOptions?

readonly optional contentTypeOptions?: boolean

Defined in: src/http/middleware/SecurityHeadersOptions.ts:32

X-Content-Type-Options: nosniff. Default true.

false is honoured server-wide only — newServerAt(…).withSecurityHeaders({ contentTypeOptions: false }) replaces the backend’s default header map, so the header stops being written. On the securityHeaders() middleware it has no visible effect: since #127 every backend writes nosniff ahead of every response it emits, and a middleware can only add headers, never take one away. So the response still carries it (#1060).

There is no route to “nosniff off for this subtree” — deliberately. The header is per-response and the backend’s copy is the last word, which is the point of putting it there: the backend’s own 404, its body-parse 413 and every error short-circuit never pass through a middleware at all.

---

crossOriginEmbedderPolicy?

readonly optional crossOriginEmbedderPolicy?: "require-corp" | "credentialless" | false

Defined in: src/http/middleware/SecurityHeadersOptions.ts:44

Cross-Origin-Embedder-Policy. Default false (breaks embeds; opt-in).

---

crossOriginOpenerPolicy?

readonly optional crossOriginOpenerPolicy?: "same-origin" | "same-origin-allow-popups" | "unsafe-none" | false

Defined in: src/http/middleware/SecurityHeadersOptions.ts:40

Cross-Origin-Opener-Policy. Default 'same-origin'; false omits it.

---

crossOriginResourcePolicy?

readonly optional crossOriginResourcePolicy?: "same-origin" | "same-site" | "cross-origin" | false

Defined in: src/http/middleware/SecurityHeadersOptions.ts:42

Cross-Origin-Resource-Policy. Default 'same-origin'; false omits it.

---

frameOptions?

readonly optional frameOptions?: "DENY" | "SAMEORIGIN" | false

Defined in: src/http/middleware/SecurityHeadersOptions.ts:34

X-Frame-Options. Default 'DENY'; false omits it.

---

hsts?

readonly optional hsts?: Partial<HstsOptionsType> | false

Defined in: src/http/middleware/SecurityHeadersOptions.ts:48

Also emit HSTS with these options. Default false (opt-in — see strictTransportSecurity).

---

permissionsPolicy?

readonly optional permissionsPolicy?: Readonly<Record<string, readonly string[]>> | false

Defined in: src/http/middleware/SecurityHeadersOptions.ts:38

Permissions-Policy as feature→allowlist. Default false (omitted).

---

referrerPolicy?

readonly optional referrerPolicy?: string | false

Defined in: src/http/middleware/SecurityHeadersOptions.ts:36

Referrer-Policy. Default 'no-referrer'; false omits it.

---

xssProtection?

readonly optional xssProtection?: boolean

Defined in: src/http/middleware/SecurityHeadersOptions.ts:46

X-XSS-Protection: 0 (disable the buggy legacy filter). Default true.