originagentcluster

Documentation

Overview

Package originagentcluster provides middleware that sets the Origin-Agent-Cluster response header on every response, requesting that the browser place the origin into its own, origin-keyed agent cluster. It is a direct port of Helmet's originAgentCluster middleware, which emits the same single, fixed header value and takes no configuration.

The Origin-Agent-Cluster header is a hint to the user agent that documents from this origin should be isolated from other origins that happen to share the same site (scheme plus registrable domain). When honored, the browser keys the agent cluster by origin rather than by site, which prevents same-site pages from reaching into this origin's synchronous scripting context via mechanisms such as document.domain and can give the origin its own dedicated process. Use it as a defense-in-depth hardening measure on applications that never rely on cross-origin, same-site DOM access.

Mechanically the middleware is trivial and stateless: for each request it sets Origin-Agent-Cluster to the structured-header boolean "?1" (meaning true) and then calls next to continue the chain. It never inspects the request, never short-circuits, and never writes a body, so it composes cleanly with any other handlers. Register it early — for example via app.Use before your routes — so the header is present on every response, including error responses produced downstream, as long as it runs before the headers are flushed.

There are no options and no defaults to reason about. The value "?1" is fixed because the header is a boolean serialized in HTTP structured-field syntax; the only alternative, "?0" (false), is already the browser default and is not worth emitting. Note that browsers may cache the isolation decision for the lifetime of a site's process, so toggling the header on and off across responses is discouraged. The header has no effect on non-supporting browsers and is safe to send unconditionally.

Parity with the Node original is exact for the observable behavior: Helmet's originAgentCluster also sets Origin-Agent-Cluster: ?1 and accepts no configuration. This port does not replicate Helmet's surrounding option-validation plumbing because there are no options to validate; the resulting header and value on every response are identical.

Index

• func New() express.Handler

Examples

• New

Functions

func New

func New() express.Handler

New returns middleware that sets Origin-Agent-Cluster: ?1.

Example

ExampleNew shows how to install the Origin-Agent-Cluster middleware on an express application. The middleware takes no configuration, so New is called with no arguments and registered globally via app.Use before any routes. Once installed, every response the app produces carries the header Origin-Agent-Cluster: ?1, requesting origin-keyed isolation from the browser. The example drives the app with httptest instead of binding a real socket: it records a GET request through app.ServeHTTP and then prints the header so the deterministic value can be asserted.

package main

import (
	"fmt"
	"net/http"
	"net/http/httptest"

	"github.com/malcolmston/express"
	"github.com/malcolmston/express/middleware/originagentcluster"
)

func main() {
	app := express.New()
	app.Use(originagentcluster.New())
	app.Get("/", func(req *express.Request, res *express.Response, next express.Next) {
		res.Send("hello")
	})

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	app.ServeHTTP(rec, req)

	fmt.Println(rec.Header().Get("Origin-Agent-Cluster"))
}

Output:
?1