helmet

Documentation

Overview

Package helmet bundles a sensible set of security-related HTTP response headers into a single express middleware, mirroring the popular Node.js Helmet defaults. It combines the behaviour of nosniff, frameguard, hsts, referrerpolicy, dnsprefetch, permittedcrossdomain, hidepoweredby, and originagentcluster.

Index

• func New(opts ...Options) express.Handler
• type Options

Functions

func New

func New(opts ...Options) express.Handler

New returns middleware that sets helmet's bundle of default security headers.

Types

type Options

type Options struct {
	// HSTSMaxAge overrides the Strict-Transport-Security max-age in seconds.
	// When zero, the default of 15552000 (180 days) is used. A negative value
	// sends max-age=0.
	HSTSMaxAge int

	// HSTSIncludeSubDomains adds the includeSubDomains directive to HSTS.
	HSTSIncludeSubDomains bool

	// FrameguardAction overrides X-Frame-Options ("SAMEORIGIN" or "DENY").
	// When empty, "SAMEORIGIN" is used.
	FrameguardAction string

	// ReferrerPolicy overrides Referrer-Policy. When empty, "no-referrer" is
	// used.
	ReferrerPolicy string
}

Options configures the helmet middleware. The zero value is usable and applies all defaults.