secheaders

package
v1.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 11, 2026 License: AGPL-3.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source
const (
	ErrXFrame      = "sec_hdr_err_xframe"
	ErrHSTSMaxAge  = "sec_hdr_err_hsts_max_age"
	ErrHSTSPreload = "sec_hdr_err_hsts_preload"
	ErrNoSniff     = "sec_hdr_err_nosniff"
	ErrReferrer    = "sec_hdr_err_referrer"
	ErrPermissions = "sec_hdr_err_permissions"
	ErrCSPExtra    = "sec_hdr_err_csp_extra"
	ErrCSPUnsafe   = "sec_hdr_err_csp_unsafe"
	ErrCSPFull     = "sec_hdr_err_csp_full"
	ErrCORS        = "sec_hdr_err_cors"
)
View Source
const (
	KeyXFrameOptions       = "security_x_frame_options"
	KeyHSTSMaxAge          = "security_hsts_max_age_seconds"
	KeyHSTSIncludeSubs     = "security_hsts_include_subdomains"
	KeyHSTSPreload         = "security_hsts_preload"
	KeyHSTSDisabled        = "security_hsts_disabled"
	KeyCSP                 = "security_csp"
	KeyCSPExtra            = "security_csp_extra"
	KeyXContentTypeOptions = "security_x_content_type_options"
	KeyReferrerPolicy      = "security_referrer_policy"
	KeyPermissionsPolicy   = "security_permissions_policy"
	KeyCORSOrigins         = "security_cors_allowed_origins"
)

Variables

View Source
var (
	XFrameChoices   = []string{"DENY", "SAMEORIGIN"}
	ReferrerChoices = []string{"no-referrer", "no-referrer-when-downgrade", "origin", "origin-when-cross-origin", "same-origin", "strict-origin", "strict-origin-when-cross-origin", "unsafe-url"}
)

Functions

func Fingerprint added in v1.4.0

func Fingerprint(get Settings) string

func MergeOrigins

func MergeOrigins(lists ...[]string) []string

func Nonce

func Nonce(r *http.Request) string

func RequestIsHTTPS

func RequestIsHTTPS(r *http.Request) bool

Types

type CSP

type CSP struct {
	// contains filtered or unexported fields
}

func NewCSP

func NewCSP() *CSP

func ParseCSP

func ParseCSP(s string) *CSP

func (*CSP) Add

func (c *CSP) Add(directive string, sources ...string) *CSP

func (*CSP) Clone

func (c *CSP) Clone() *CSP

func (*CSP) Has

func (c *CSP) Has(directive string) bool

func (*CSP) Remove

func (c *CSP) Remove(directive string) *CSP

func (*CSP) Set

func (c *CSP) Set(directive string, sources ...string) *CSP

func (*CSP) Sources

func (c *CSP) Sources(directive string) []string

func (*CSP) String

func (c *CSP) String() string

type Change added in v1.4.0

type Change struct {
	Key string
	Old string
	New string
}

type Config

type Config struct {
	XFrameOptions         string
	HSTSMaxAgeSeconds     int
	HSTSIncludeSubDomains bool
	HSTSPreload           bool
	HSTSDisabled          bool
	CSP                   *CSP
	XContentTypeOptions   string
	ReferrerPolicy        string
	PermissionsPolicy     string
	CORSAllowedOrigins    []string
	CORSAllowedHeaders    []string
	StyleNonce            bool
	NoStoreCacheControl   string
	StaticPrefixes        []string
	StaticPaths           []string
	StaticCacheControl    string
	LegacyHeaders         bool
	PerRequest            func(r *http.Request, rq *Request)
}

func Defaults

func Defaults() *Config

func (*Config) ApplySettings

func (c *Config) ApplySettings(get Settings)

func (*Config) CORS

func (c *Config) CORS(next http.Handler) http.Handler

func (*Config) Middleware

func (c *Config) Middleware(next http.Handler) http.Handler

type Editor added in v1.4.0

type Editor struct {
	Get    Settings
	Set    func(key, value string) error
	Live   *Live
	Reload func()
}

func (*Editor) Load added in v1.4.0

func (e *Editor) Load() View

func (*Editor) Reset added in v1.4.0

func (e *Editor) Reset() ([]Change, error)

func (*Editor) Save added in v1.4.0

func (e *Editor) Save(vals map[string]string) ([]Change, error)

func (*Editor) Validate added in v1.4.0

func (e *Editor) Validate(f Form) (map[string]string, map[string]string)

type EffectiveHeaders added in v1.4.0

type EffectiveHeaders struct {
	XFrameOptions     string
	HSTS              string
	ContentTypeOpts   string
	ReferrerPolicy    string
	PermissionsPolicy string
	CSP               string
	CORSOrigins       string
}

type Form added in v1.4.0

type Form struct {
	XFrameOptions      string
	HSTSDisabled       bool
	HSTSMaxAge         string
	HSTSIncludeSubs    bool
	HSTSPreload        bool
	ContentTypeOptions string
	ReferrerPolicy     string
	PermissionsPolicy  string
	CSPExtra           string
	CSPFull            string
	CORSOrigins        string
}

func FormFromRequest added in v1.4.0

func FormFromRequest(r *http.Request) Form

type Live added in v1.4.0

type Live struct {
	// contains filtered or unexported fields
}

func NewLive added in v1.4.0

func NewLive(build func() *Config) *Live

func (*Live) CORS added in v1.4.0

func (l *Live) CORS(next http.Handler) http.Handler

func (*Live) Config added in v1.4.0

func (l *Live) Config() *Config

func (*Live) Middleware added in v1.4.0

func (l *Live) Middleware(next http.Handler) http.Handler

func (*Live) Reload added in v1.4.0

func (l *Live) Reload() *Config

func (*Live) Watch added in v1.4.0

func (l *Live) Watch(interval time.Duration, fingerprint func() string)

type Request

type Request struct {
	CSP              *CSP
	OmitFrameOptions bool
	CacheControl     string
	Headers          map[string]string
}

type Settings

type Settings func(key string) string

type View added in v1.4.0

type View struct {
	Form      Form
	Errors    map[string]string
	Effective EffectiveHeaders
	Defaults  EffectiveHeaders
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL