release: WRNexusJS 0.7.0

packages/core/src/headers.ts

@@ -60,9 +60,23 @@ export interface TrustedTypesConfig {
 
 export type PermissionsPolicyConfig = Record<string, string | string[] | false | null | undefined>;
 
+export interface RequestLimitsConfig {
+  maxUrlLength?: number;
+  maxHeaderCount?: number;
+  maxHeaderBytes?: number;
+  maxQueryParameters?: number;
+  maxBodyBytes?: number;
+  timeoutMs?: number;
+  maxConcurrent?: number;
+  trustedHosts?: string[];
+  fetchMetadata?: boolean;
+}
+
 export interface SecurityConfig {
   /** Set false to skip all framework security headers except explicitly enabled CORS. */
   headers?: boolean;
+  /** Built-in request size, timeout, concurrency, host, and Fetch Metadata limits. */
+  requestLimits?: RequestLimitsConfig;
   /**
    * Trust `X-Forwarded-Proto` / `X-Forwarded-Host` when building `ctx.url` — set
    * this when the app runs behind a TLS-terminating reverse proxy (nginx, the
@@ -81,6 +95,12 @@ export interface SecurityConfig {
   frameOptions?: false | "DENY" | "SAMEORIGIN";
   /** Defaults to "strict-origin-when-cross-origin". */
   referrerPolicy?: false | string;
+  /** Defaults to "same-origin". */
+  crossOriginResourcePolicy?: false | "same-origin" | "same-site" | "cross-origin";
+  /** Isolate the origin in its own agent cluster. Defaults to true. */
+  originAgentCluster?: boolean;
+  /** Disable speculative DNS prefetching. Defaults to true. */
+  disableDnsPrefetch?: boolean;
   /** Defaults to a restrictive browser capability policy. */
   permissionsPolicy?: false | PermissionsPolicyConfig;
   /** Extra static headers applied last. */
@@ -238,6 +258,11 @@ function applyBaseSecurityHeaders(
   const referrerPolicy = security?.referrerPolicy ?? "strict-origin-when-cross-origin";
   if (referrerPolicy !== false) headers.set("Referrer-Policy", referrerPolicy);
 
+  const corp = security?.crossOriginResourcePolicy ?? "same-origin";
+  if (corp !== false) headers.set("Cross-Origin-Resource-Policy", corp);
+  if (security?.originAgentCluster !== false) headers.set("Origin-Agent-Cluster", "?1");
+  if (security?.disableDnsPrefetch !== false) headers.set("X-DNS-Prefetch-Control", "off");
+
   const configuredPermissions = security?.permissionsPolicy;
   const permissionsPolicy =
     configuredPermissions === false