SecurityHeaders class

Adds security headers to every answer. Each header has a safe default. Give your own value to change it, or null to turn it off.

AppConfig(
  globalMiddleware: <dynamic>[
    SecurityHeaders(frameOptions: 'SAMEORIGIN', permissionsPolicy: null),
  ],
);

Strict-Transport-Security is sent only on https requests. Behind a proxy, add the proxy to AppConfig.trustedProxies, so Dox believes its X-Forwarded-Proto: https header.

Implemented types

Constructors

SecurityHeaders({String? contentTypeOptions = 'nosniff', String? frameOptions = 'DENY', String? referrerPolicy = 'strict-origin-when-cross-origin', String? strictTransportSecurity = 'max-age=31536000; includeSubDomains', String? permissionsPolicy = 'camera=(), microphone=(), geolocation=()', String? crossOriginOpenerPolicy = 'same-origin', String? contentSecurityPolicy, Map<String, String> extra = const <String, String>{}})
const

Properties

contentSecurityPolicy → String?
Content-Security-Policy. Off by default, because a good policy depends on the pages of the app. Eg. frame-ancestors 'none'.
final
contentTypeOptions → String?
X-Content-Type-Options: the browser must not guess the type.
final
crossOriginOpenerPolicy → String?
Cross-Origin-Opener-Policy: other sites that open this page in a window can not reach it.
final
extra → Map<String, String>
more headers to add, name to value
final
frameOptions → String?
X-Frame-Options: no other site can show the page in a frame.
final
hashCode → int
The hash code for this object.
no setterinherited
permissionsPolicy → String?
Permissions-Policy: browser features the page can not use.
final
referrerPolicy → String?
Referrer-Policy: how much of the url goes to other sites.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
strictTransportSecurity → String?
Strict-Transport-Security: the browser uses only https from now on. Sent only when the request came in over https.
final

Methods

handle(IDoxRequest req) → IDoxRequest
override
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited