43 lines
1.3 KiB
TypeScript
43 lines
1.3 KiB
TypeScript
import type { SecurityConfig } from "@wrnexus/core";
|
|
|
|
export type SecurityPreset = "balanced" | "strict" | "api";
|
|
|
|
export function securityPreset(preset: SecurityPreset = "balanced"): SecurityConfig {
|
|
if (preset === "api") {
|
|
return {
|
|
contentSecurityPolicy: false,
|
|
frameOptions: "DENY",
|
|
crossOriginOpenerPolicy: "same-origin",
|
|
referrerPolicy: "no-referrer",
|
|
permissionsPolicy: {},
|
|
extraHeaders: {
|
|
"Cross-Origin-Resource-Policy": "same-origin",
|
|
"Cache-Control": "no-store",
|
|
},
|
|
};
|
|
}
|
|
if (preset === "strict") {
|
|
return {
|
|
contentSecurityPolicy: {
|
|
useDefaults: true,
|
|
directives: {
|
|
"style-src": ["'self'"],
|
|
"script-src": ["'self'"],
|
|
"upgrade-insecure-requests": [],
|
|
},
|
|
},
|
|
trustedTypes: { enabled: true, policyNames: ["wrnexus"], requireForScript: true },
|
|
hsts: { enabled: true, maxAge: 63_072_000, includeSubDomains: true, preload: true },
|
|
extraHeaders: {
|
|
"Cross-Origin-Resource-Policy": "same-origin",
|
|
"Origin-Agent-Cluster": "?1",
|
|
},
|
|
};
|
|
}
|
|
return {
|
|
contentSecurityPolicy: { useDefaults: true },
|
|
trustedTypes: { enabled: true, requireForScript: true },
|
|
extraHeaders: { "Cross-Origin-Resource-Policy": "same-origin" },
|
|
};
|
|
}
|