secure

Overview ¶

Package secure changes the security headers a Tern app sends. Since v1.16 kit sends them without the plugin (see ADR 0027): pages cannot be framed by other sites, referrers are trimmed for cross-origin requests, powerful browser features are off, and the page gets its own browsing context group. Add the plugin to change one, or for HTTPS-only (HSTS), which is opt-in because it is hard to undo:

ternApp(kit.WithPlugins(secure.New(secure.HSTS(365*24*time.Hour, false))))

For the Content-Security-Policy, see kit.WithCSPSources and kit.WithContentSecurityPolicy, which handle nonces.