secure

Overview ¶

Package secure sets security headers on every response of a Tern app:

ternApp(kit.WithPlugins(secure.New()))

The defaults are safe for most apps: pages cannot be framed by other sites, referrers are trimmed for cross-origin requests, powerful browser features are off, and the page gets its own browsing context group. HTTPS-only (HSTS) is opt-in with HSTS, because it is hard to undo. For a Content-Security-Policy, use kit.WithContentSecurityPolicy, which handles nonces.