Documentation
¶
Overview ¶
Package secure provides security response headers as a burrow contrib app. It wraps github.com/unrolled/secure and sets sensible defaults for X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and HSTS.
By default, HSTS is enabled when the server's BaseURL uses HTTPS and disabled for plain HTTP. Content-Security-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy are not set unless explicitly configured, as no safe universal default exists for these headers.
Index ¶
- type App
- type Option
- func WithAllowedHosts(hosts ...string) Option
- func WithContentSecurityPolicy(csp string) Option
- func WithCrossOriginOpenerPolicy(coop string) Option
- func WithDevelopment(dev bool) Option
- func WithPermissionsPolicy(pp string) Option
- func WithSSLProxyHeaders(headers map[string]string) Option
- func WithSSLRedirect(redirect bool) Option
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type App ¶
type App struct {
// contains filtered or unexported fields
}
App implements security response headers as a burrow contrib app.
func New ¶
New creates a new secure headers app with the given options.
Example ¶
package main
import (
"fmt"
"github.com/oliverandrich/burrow/contrib/secure"
)
func main() {
// Zero-config: sets X-Content-Type-Options, X-Frame-Options,
// Referrer-Policy, and auto-detects HSTS from BaseURL.
app := secure.New()
fmt.Println(app.Name())
}
Output: secure
type Option ¶
type Option func(*App)
Option configures the secure app.
func WithAllowedHosts ¶
WithAllowedHosts sets the list of allowed hostnames for Host header validation.
func WithContentSecurityPolicy ¶
WithContentSecurityPolicy sets the Content-Security-Policy header.
Example ¶
package main
import (
"fmt"
"github.com/oliverandrich/burrow/contrib/secure"
)
func main() {
app := secure.New(
secure.WithContentSecurityPolicy("default-src 'self'; script-src 'self'"),
secure.WithPermissionsPolicy("camera=(), microphone=()"),
)
fmt.Println(app.Name())
}
Output: secure
func WithCrossOriginOpenerPolicy ¶
WithCrossOriginOpenerPolicy sets the Cross-Origin-Opener-Policy header.
func WithDevelopment ¶
WithDevelopment forces development mode on or off, overriding auto-detection.
func WithPermissionsPolicy ¶
WithPermissionsPolicy sets the Permissions-Policy header.
func WithSSLProxyHeaders ¶
WithSSLProxyHeaders sets proxy headers used to detect HTTPS behind a reverse proxy.
func WithSSLRedirect ¶
WithSSLRedirect enables or disables HTTP-to-HTTPS redirect.
Source Files