secureheaders

type Config struct {
	// HSTS configures the Strict-Transport-Security header.
	// Zero MaxAge disables the header (useful behind a TLS-terminating proxy).
	HSTS HSTSConfig

	// ContentTypeOpts emits "X-Content-Type-Options: nosniff" when true.
	ContentTypeOpts bool

	// FrameOptions controls the X-Frame-Options header.
	// Accepted values: "DENY", "SAMEORIGIN". Empty disables the header.
	FrameOptions string

	// XSSProtection emits "X-XSS-Protection: 1; mode=block" when true.
	// Note: modern browsers ignore this header in favour of CSP, but it is
	// harmless and helps with older browsers.
	XSSProtection bool

	// CSP is the full value for the Content-Security-Policy header.
	// Example: "default-src 'self'; img-src *; script-src 'self'"
	// Empty disables the header.
	CSP string

	// ReferrerPolicy sets the Referrer-Policy header.
	// Recommended: "strict-origin-when-cross-origin".
	// Empty disables the header.
	ReferrerPolicy string

	// PermissionsPolicy sets the Permissions-Policy header.
	// Example: "geolocation=(), microphone=(), camera=()"
	// Empty disables the header.
	PermissionsPolicy string

	// COEP sets the Cross-Origin-Embedder-Policy header.
	// Use "require-corp" to enable cross-origin isolation.
	COEP string

	// COOP sets the Cross-Origin-Opener-Policy header.
	// Use "same-origin" to prevent cross-origin window references.
	COOP string

	// CORP sets the Cross-Origin-Resource-Policy header.
	// Use "same-origin" or "same-site" to restrict resource sharing.
	CORP string

	// RemoveServerHeader strips the "Server" response header when true.
	RemoveServerHeader bool

	// RemovePoweredBy strips the "X-Powered-By" response header when true.
	RemovePoweredBy bool
}

type HSTSConfig struct {
	// MaxAge is how long browsers should remember to use HTTPS (default: 1 year).
	// Set to 0 to disable HSTS.
	MaxAge time.Duration
	// IncludeSubDomains extends HSTS to all subdomains.
	IncludeSubDomains bool
	// Preload signals intent to be included in browser HSTS preload lists.
	// Only set this if you have submitted your domain at https://hstspreload.org.
	Preload bool
}