security.go RawHistoryFolder

1package middleware
2
3import "net/http"
4
5// SecurityHeaders adds standard security headers to HTTP responses.
6// HSTS is set automatically when the connection uses TLS (r.TLS != nil).
7func SecurityHeaders(next http.Handler) http.Handler {
8	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
9		w.Header().Set("X-Content-Type-Options", "nosniff")
10		w.Header().Set("X-Frame-Options", "DENY")
11		w.Header().Set("X-XSS-Protection", "1; mode=block")
12		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
13		w.Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
14
15		if r.TLS != nil {
16			w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
17		}
18
19		next.ServeHTTP(w, r)
20	})
21}