SecurityOptions

import type { SecurityOptions } from "@shadow-js/dusk/server";

interface SecurityOptions {
  /**
   * Host names the server answers for (`example.com`, `example.com:8443`, `*.example.com`). A
   * request for another host gets 400. Required in production (createHandler throws without it):
   * the Host header is attacker input. An empty list means no host check, and in production it
   * also needs `acknowledgeNoHostCheck: true`.
   */
  readonly allowedHosts?: readonly string[];
  /**
   * Set with `allowedHosts: []` in production to accept any Host on purpose (for example behind a
   * proxy that already checks it). Without it, production refuses an empty list. Default false.
   */
  readonly acknowledgeNoHostCheck?: boolean;
  /** Cross-origin access to API routes for the listed origins (see `cors.ts`). */
  readonly cors?: CorsOptions;
  /** Response headers; `false` turns them all off. */
  readonly headers?: false | SecureHeadersOptions;
  /** Content-Security-Policy with a per-request nonce. Off by default. */
  readonly csp?: false | CspOptions;
  /** CSRF check for state-changing requests; `false` turns it off (not recommended). */
  readonly csrf?: false | CsrfOptions;
  /** Secrets for signed cookies and sessions; the first signs, all verify (rotation). 32+ characters. */
  readonly cookieSecrets?: readonly string[];
  /** Size, time and URL limits. */
  readonly limits?: LimitsOptions;
  /** Derive the client address from a proxy header. Off by default (the peer address is used). */
  readonly trustProxy?: false | TrustProxyOptions;
  /** Generate a nonce even without a CSP, for apps that set their own header. Default false. */
  readonly nonce?: boolean;
  /**
   * The `x-request-id` header on every answer (OPTIONS, 404 and 405 included). `true` (default)
   * sends the request id; `false` omits the header; a function returns the value (a function can be given
   * here only: `dusk.config.ts` is written into the bundle, so it takes `true` or `false`). A header the route or
   * the handler set is kept.
   */
  readonly requestId?: boolean | ((event: RequestEvent) => string);
  /**
   * The answer to a method the route does not accept. `"json"` (default): the error body, as for any error.
   * `"empty"`: an empty 405 with no body. `Allow` is sent in both shapes.
   */
  readonly methodNotAllowed?: "json" | "empty";
  /**
   * The `cache-control` of a response that sets none (a page or an API answer). Default `private, no-store`. A string
   * replaces it; `false` leaves such responses without the header. A route rule's `cacheControl` replaces it for its
   * paths, and a `cache-control` the route or a header rule sets always wins.
   */
  readonly defaultCacheControl?: string | false;
}