SecurityHeaders class

Adds security headers to every answer. Each header has a safe default. Give your own value to change it, or null to turn it off. null also removes a header that the server sends by default, like X-Frame-Options: SAMEORIGIN.

AppConfig(
  globalMiddleware: <dynamic>[
    SecurityHeaders(frameOptions: 'SAMEORIGIN', permissionsPolicy: null),
  ],
);

Strict-Transport-Security is sent only on https requests. Behind a proxy, add the proxy to AppConfig.trustedProxies, so Dox believes its X-Forwarded-Proto: https header.

Implemented types

Constructors

SecurityHeaders({String? contentTypeOptions = 'nosniff', String? frameOptions = 'DENY', String? referrerPolicy = 'strict-origin-when-cross-origin', String? strictTransportSecurity = 'max-age=31536000; includeSubDomains', String? permissionsPolicy = 'camera=(), microphone=(), geolocation=()', String? crossOriginOpenerPolicy = 'same-origin', String? contentSecurityPolicy, String? xssProtection = '0', Map<String, String?> extra = const <String, String?>{}})
const

Properties

contentSecurityPolicy → String?
Content-Security-Policy. Off by default, because a good policy depends on the pages of the app. Eg. frame-ancestors 'none'.
final
contentTypeOptions → String?
X-Content-Type-Options: the browser must not guess the type.
final
crossOriginOpenerPolicy → String?
Cross-Origin-Opener-Policy: other sites that open this page in a window can not reach it.
final
extra → Map<String, String?>
more headers to add, name to value. A null value removes the header.
final
frameOptions → String?
X-Frame-Options: no other site can show the page in a frame.
final
hashCode → int
The hash code for this object.
no setterinherited
permissionsPolicy → String?
Permissions-Policy: browser features the page can not use.
final
referrerPolicy → String?
Referrer-Policy: how much of the url goes to other sites.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
strictTransportSecurity → String?
Strict-Transport-Security: the browser uses only https from now on. Sent only when the request came in over https.
final
xssProtection → String?
X-XSS-Protection. 0 turns the old XSS filter of browsers off, like OWASP says. The filter is gone from new browsers, and in old ones it can make holes. Use contentSecurityPolicy instead.
final

Methods

handle(IDoxRequest req) → IDoxRequest
override
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited