SecurityHeaders class

Sets the response headers browsers use to constrain what a page may do.

Inheritance

Constructors

SecurityHeaders({String? contentTypeOptions = 'nosniff', String? frameOptions = 'DENY', String? referrerPolicy = 'strict-origin-when-cross-origin', String? contentSecurityPolicy, String? permissionsPolicy, String? strictTransportSecurity, String? xssProtection, bool removeServerHeader = true})

Properties

contentSecurityPolicy → String?
Opt-in: a wrong CSP breaks the page, so there is no safe default. A reasonable starting point for a server-rendered app is "default-src 'self'".
final
contentTypeOptions → String?
Stops the browser second-guessing Content-Type. Without it, a user-uploaded file served as text/plain can be sniffed as HTML and executed in the site's origin.
final
frameOptions → String?
Clickjacking protection. DENY, SAMEORIGIN, or null to omit.
final
hashCode → int
The hash code for this object.
no setterinherited
permissionsPolicy → String?
Opt-in, e.g. "geolocation=(), camera=(), microphone=()".
final
referrerPolicy → String?
Keeps full URLs — which routinely carry tokens and ids — out of the Referer sent to other origins.
final
removeServerHeader → bool
Drops the server header, which advertises the runtime version.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
strictTransportSecurity → String?
HSTS. Only emitted over HTTPS — sending it over plain HTTP is meaningless, and browsers ignore it there. Defaults to one year plus subdomains when APP_SECURE is on; pass an explicit value to override, or an empty string to suppress it.
final
xssProtection → String?
X-XSS-Protection. Defaults to null, which removes the header Dart sets. The legacy XSS auditor is gone from current browsers and had its own bypass-to-injection issues; CSP is the replacement.
final

Methods

handle(Request req) → Future<void>
Inspect or reject the request. Throw to abort the chain.
override
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
process(Request req, Next next) → Future<void>
Wraps the rest of the chain.
inherited
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited