secureHeaders
Middleware that adds common security headers to every response. X-Content-Type-Options: nosniff and Cross-Origin-Opener-Policy: same-origin are always set. Pass false to any option to turn that header off.
Source
Type Definition
function secureHeaders(options?: SecureHeadersOptions): AtomicHandler
type SecureHeadersOptions = {
contentSecurityPolicy?: string | false
frameOptions?: 'DENY' | 'SAMEORIGIN' | false
hsts?: string | false
referrerPolicy?: string | false
permissionsPolicy?: string | false
}Parameters
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
options | SecureHeadersOptions | ❌ | - | Header values to override |
Properties
| Property | Type | Required | Default | Description |
|---|---|---|---|---|
contentSecurityPolicy | string | false | ❌ | false | Content-Security-Policy value. Off by default because every app needs its own policy |
frameOptions | 'DENY' | 'SAMEORIGIN' | false | ❌ | SAMEORIGIN | X-Frame-Options value, to prevent clickjacking |
hsts | string | false | ❌ | max-age=15552000; includeSubDomains | Strict-Transport-Security value. Only sent over https or when x-forwarded-proto is https |
referrerPolicy | string | false | ❌ | strict-origin-when-cross-origin | Referrer-Policy value |
permissionsPolicy | string | false | ❌ | camera=(), microphone=(), geolocation=() | Permissions-Policy value |
Last modified: 2026-10-02