Security Headers

Regius includes a security headers middleware that sets a bundle of HTTP security response headers out of the box — an Express "helmet" equivalent — to harden every response against XSS, clickjacking, MIME-sniffing, and SSL-downgrade attacks.

Features

• Opt-in by default: Disabled unless SECURITY_HEADERS_ENABLED=true
• Helmet-style safe defaults: Content-Security-Policy (default-src 'self'), X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy, Cross-Origin-Opener/Resource-Policy, and more
• HSTS auto-gated: Strict-Transport-Security is only emitted when SECURE=true, so it never locks you out of local dev over http://localhost
• Per-header overrides: Configure CSP, HSTS max-age, Referrer-Policy, etc. via environment variables
• Non-blocking: Headers are set before the downstream handler, so a route can still override any header via w.Header().Set(...)

Usage

Security headers are applied globally when SECURITY_HEADERS_ENABLED=true. No additional code is required.

To override a header for a specific route, set it in the handler:

func (a *App) WidgetShow(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Content-Security-Policy", "default-src 'self'; img-src https://cdn.example.com")
    // ...
}

Or build the middleware manually for a route group:

r.Group(func(mux chi.Router) {
    mux.Use(a.SecurityHeaders(regius.SecurityHeadersConfig{
        Enabled:               true,
        ContentSecurityPolicy: "default-src 'self'; script-src 'self'",
        HSTSIncludeSubDomains: true,
    }))
    // routes here
})

Configuration Options

config := regius.SecurityHeadersConfig{
    Enabled:                       true,
    ContentSecurityPolicy:         "default-src 'self'",
    HSTSMaxAge:                    31536000,
    HSTSIncludeSubDomains:         true,
    HSTSPreload:                   false,
    ReferrerPolicy:                "strict-origin-when-cross-origin",
    XFrameOptions:                 "SAMEORIGIN",
    XPermittedCrossDomainPolicies: "none",
    CrossOriginOpenerPolicy:       "same-origin",
    CrossOriginResourcePolicy:     "same-origin",
    XDNSPrefetchControl:           "off",
}

Option	Type	Description
Enabled	bool	Master toggle
ContentSecurityPolicy	string	CSP header value (empty uses default)
HSTSMaxAge	int	HSTS max-age (0 uses 1 year default)
HSTSIncludeSubDomains	bool	Add includeSubDomains to HSTS
HSTSPreload	bool	Add preload to HSTS
ReferrerPolicy	string	Referrer-Policy header value
XFrameOptions	string	X-Frame-Options header value
CrossOriginOpenerPolicy	string	Cross-Origin-Opener-Policy value
CrossOriginResourcePolicy	string	Cross-Origin-Resource-Policy value
XDNSPrefetchControl	string	X-DNS-Prefetch-Control value

Environment Variables

SECURITY_HEADERS_ENABLED=false
CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; style-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; img-src 'self' data:; font-src 'self' https://cdn.jsdelivr.net; frame-ancestors 'self'
HSTS_MAX_AGE=31536000
HSTS_INCLUDE_SUBDOMAINS=true
HSTS_PRELOAD=false
REFERRER_POLICY=strict-origin-when-cross-origin
X_FRAME_OPTIONS=SAMEORIGIN