What is on by default
What is on by default in the Security guide.
| Protection | Default | Change it with |
|---|---|---|
| Response headers | X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, a restrictive Permissions-Policy, X-Frame-Options: SAMEORIGIN |
security.headers (Secure headers) |
| HSTS | off | security.headers.hsts, sent on https requests only |
| Content-Security-Policy | off | security.csp (CSP) |
| CSRF | on for every method except GET, HEAD and OPTIONS, for pages, API routes and server functions | security.csrf, trustedOrigins, export const csrf = false in an API route (CSRF) |
| Host allow-list | off; when dev is false, the first request gets one warning through onWarning (default console.warn) |
security.allowedHosts (Hosts) |
| Limits | URL 8192 characters (414), body 1 MiB (413), response head 30 s (504), streamed page 120 s | security.limits (Limits) |
Cache-Control |
private, no-store unless the response sets its own (security.defaultCacheControl and a route rule's cacheControl change the default) |
set it on the response |
| Cookies | HttpOnly; Secure; SameSite=Lax; Path=/ |
the options argument (Cookies) |
| Redirect targets | checked: no //host, no foreign origin |
trustedOrigins (Redirects) |
| Errors | in production a 5xx shows its reason phrase; the detail goes to onError once |
onError, dev (Errors) |
| Request id | x-request-id, generated per request, never taken from the client; a value the route or the handler sets is kept |
n/a |