flowingts / SecurityHeadersOptions

Interface: SecurityHeadersOptions

Definido em: src/middlewares/security-headers.ts:3

Propriedades

contentSecurityPolicy?

optional contentSecurityPolicy?: string | false

Definido em: src/middlewares/security-headers.ts:5

Padrão: default-src 'none'; frame-ancestors 'none' (adequado para APIs JSON). false desliga.

---

crossOriginResourcePolicy?

optional crossOriginResourcePolicy?: false | "same-origin" | "same-site" | "cross-origin"

Definido em: src/middlewares/security-headers.ts:11

Padrão: same-origin.

---

frameOptions?

optional frameOptions?: false | "DENY" | "SAMEORIGIN"

Definido em: src/middlewares/security-headers.ts:9

Padrão: DENY.

---

referrerPolicy?

optional referrerPolicy?: string | false

Definido em: src/middlewares/security-headers.ts:7

Padrão: no-referrer.

---

strictTransportSecurity?

optional strictTransportSecurity?: boolean | { includeSubDomains?: boolean; maxAge: number; preload?: boolean; }

Definido em: src/middlewares/security-headers.ts:16

HSTS é opt-in: só faz sentido atrás de HTTPS. true = max-age=15552000; includeSubDomains (180 dias).