Beignet API reference
    Preparing search index...

    Interface SecurityHeadersOptions

    Response security headers applied by createSecurityHeadersHooks(...).

    Headers are only added when the response does not already define the same header name. Route handlers can therefore opt into route-specific CSP or download headers without fighting the global hook.

    interface SecurityHeadersOptions {
        contentSecurityPolicy?: string | false;
        crossOriginOpenerPolicy?: string | false;
        crossOriginResourcePolicy?: string | false;
        permissionsPolicy?: string | false;
        referrerPolicy?: string | false;
        strictTransportSecurity?: string | false | StrictTransportSecurityOptions;
        xContentTypeOptions?: false | "nosniff";
        xFrameOptions?: false | "DENY" | "SAMEORIGIN";
    }
    Index
    contentSecurityPolicy? crossOriginOpenerPolicy? crossOriginResourcePolicy? permissionsPolicy? referrerPolicy? strictTransportSecurity? xContentTypeOptions? xFrameOptions?
    contentSecurityPolicy?: string | false

    Content Security Policy value. Disabled by default because browser apps need an app-owned asset, image, frame, and script policy.

    crossOriginOpenerPolicy?: string | false

    Cross-Origin-Opener-Policy value.

    Defaults to "same-origin".

    crossOriginResourcePolicy?: string | false

    Cross-Origin-Resource-Policy value.

    Defaults to "same-origin".

    permissionsPolicy?: string | false

    Permissions-Policy value.

    Defaults to disabling camera, microphone, and geolocation.

    referrerPolicy?: string | false

    Referrer-Policy value.

    Defaults to "strict-origin-when-cross-origin".

    strictTransportSecurity?: string | false | StrictTransportSecurityOptions

    Strict-Transport-Security value. Pass a string for full control or an object for Beignet to format the header. Disabled by default.

    xContentTypeOptions?: false | "nosniff"

    X-Content-Type-Options value.

    Defaults to "nosniff".

    xFrameOptions?: false | "DENY" | "SAMEORIGIN"

    X-Frame-Options value.

    Defaults to "DENY". Use contentSecurityPolicy with frame-ancestors for more precise frame control.

    Settings
    Member Visibility

    On This Page
    Properties