secure

Documentation

Overview

Package secure is middleware that provides protection against cross-site scripting (XSS) attack, content type sniffing, clickjacking, insecure connection and other code injection attacks

Index

• Variables
• func Secure(conf *Config) echo.MiddlewareFunc
• type Config

Variables

var DefaultConfig = Config{
	Enabled:               true,
	Skipper:               middleware.DefaultSkipper,
	XSSProtection:         "1; mode=block",
	ContentTypeNosniff:    "nosniff",
	XFrameOptions:         "SAMEORIGIN",
	HSTSPreloadEnabled:    false,
	HSTSMaxAge:            31536000,
	ContentSecurityPolicy: "default-src 'self'",
	ReferrerPolicy:        "same-origin",
	CSPReportOnly:         false,
}

DefaultConfig struct is a populated config struct that can be referenced if the default konaf configurations are not available

Functions

func Secure

func Secure(conf *Config) echo.MiddlewareFunc

Secure returns a secure middleware with default unless overridden via the config

Types

type Config

type Config struct {
	// Enabled indicates if the secure middleware should be enabled
	Enabled bool `json:"enabled" koanf:"enabled" default:"true"`
	// Skipper defines a function to skip middleware
	Skipper middleware.Skipper `json:"-" koanf:"-"`
	// XSSProtection is the value to set the X-XSS-Protection header to - default is 1; mode=block
	XSSProtection string `json:"xssprotection" koanf:"xssprotection" default:"1; mode=block"`
	// ContentTypeNosniff is the value to set the X-Content-Type-Options header to - default is nosniff
	ContentTypeNosniff string `json:"contenttypenosniff" koanf:"contenttypenosniff" default:"nosniff"`
	// XFrameOptions is the value to set the X-Frame-Options header to - default is SAMEORIGIN
	XFrameOptions string `json:"xframeoptions" koanf:"xframeoptions" default:"SAMEORIGIN"`
	// HSTSPreloadEnabled is a boolean to enable HSTS preloading - default is false
	HSTSPreloadEnabled bool `json:"hstspreloadenabled" koanf:"hstspreloadenabled" default:"false"`
	// HSTSMaxAge is the max age to set the HSTS header to - default is 31536000
	HSTSMaxAge int `json:"hstsmaxage" koanf:"hstsmaxage" default:"31536000"`
	// ContentSecurityPolicy is the value to set the Content-Security-Policy header to - default is default-src 'self'
	ContentSecurityPolicy string `json:"contentsecuritypolicy" koanf:"contentsecuritypolicy" default:"default-src 'self'"`
	// ReferrerPolicy is the value to set the Referrer-Policy header to - default is same-origin
	ReferrerPolicy string `json:"referrerpolicy" koanf:"referrerpolicy" default:"same-origin"`
	// CSPReportOnly is a boolean to enable the Content-Security-Policy-Report-Only header - default is false
	CSPReportOnly bool `json:"cspreportonly" koanf:"cspreportonly" default:"false"`
}

Config contains the types used in the mw middleware