You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. use the proper HTTP Header names like `Cross-Origin-Embedder-Policy` instead of `crossOriginEmbedderPolicy` and to not set the headers inside `security`. These headers are handled by Nuxt and you can check more [here](https://nuxt.com/docs/guide/concepts/rendering#hybrid-rendering).
63
+
2. add middleware inside of `security` in certain route rule. This is a custom NuxtSecurity addition that does not exists in core Nuxt.
64
+
::
65
+
59
66
You can also use route roules in pages like following:
60
67
61
68
```vue
@@ -79,12 +86,19 @@ defineRouteRules({
79
86
```
80
87
81
88
::alert{type="warning"}
82
-
When using `routeRules`, make sure to:
89
+
To enable this macro, add following configuration to your `nuxt.config.ts` file:
90
+
91
+
```ts
92
+
experimental: {
93
+
inlineRouteRules: true
94
+
},
95
+
```
83
96
84
-
1. use the proper HTTP Header names like `Cross-Origin-Embedder-Policy` instead of `crossOriginEmbedderPolicy` and to not set the headers inside `security`. These headers are handled by Nuxt and you can check more [here](https://nuxt.com/docs/guide/concepts/rendering#hybrid-rendering).
85
-
2. add middleware inside of `security` in certain route rule. This is a custom NuxtSecurity addition that does not exists in core Nuxt.
86
97
::
87
98
99
+
100
+
101
+
88
102
## Disabling functionality
89
103
90
104
To disable certain middleware or headers, follow this pattern:
:badge[Enabled]{type="success"} Smaller but still important security response headers.
4
+
5
+
---
6
+
7
+
:ellipsis{right=0pxwidth=75%blur=150px}
8
+
9
+
The X-DNS-Prefetch-Control HTTP response header controls DNS prefetching, a feature by which browsers proactively perform domain name resolution on both links that the user may choose to follow as well as URLs for items referenced by the document, including images, CSS, JavaScript, and so forth. This prefetching is performed in the background, so that the DNS is likely to have been resolved by the time the referenced items are needed. This reduces latency when the user clicks a link.
10
+
11
+
::alert{type="info"}
12
+
ℹ Read more about this header [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control).
13
+
::
14
+
15
+
## Usage
16
+
17
+
This header is enabled by default but you can change its behavior like following.
18
+
19
+
```ts
20
+
exportdefaultdefineNuxtConfig({
21
+
// Global
22
+
security: {
23
+
headers: {
24
+
xDNSPrefetchControl: <OPTIONS>,
25
+
},
26
+
},
27
+
28
+
// Per route
29
+
routeRules: {
30
+
'/custom-route': {
31
+
headers: {
32
+
'X-DNS-Prefetch-Control': <OPTIONS>
33
+
},
34
+
}
35
+
}
36
+
})
37
+
```
38
+
39
+
You can also disable this header by `xDNSPrefetchControl: false`.
40
+
41
+
## Default value
42
+
43
+
By default, Nuxt Security will set following value for this header.
44
+
45
+
```http
46
+
X-DNS-Prefetch-Control: off
47
+
```
48
+
49
+
## Available values
50
+
51
+
The `xDNSPrefetchControl` header can be configured with following values.
52
+
53
+
```ts
54
+
xDNSPrefetchControl: 'on'|'off'|false;
55
+
```
56
+
57
+
### `on`
58
+
59
+
Enables DNS prefetching. This is what browsers do, if they support the feature, when this header is not present
60
+
61
+
### `off`
62
+
63
+
Disables DNS prefetching. This is useful if you don't control the link on the pages, or know that you don't want to leak information to these domains.
:badge[Enabled]{type="success"} Instruct Internet Explorer to not open a downloaded file directly.
4
+
5
+
---
6
+
7
+
:ellipsis{right=0pxwidth=75%blur=150px}
8
+
9
+
The X-Download-Options HTTP header has only one option: X-Download-Options: noopen. This is for Internet Explorer from version 8 on to instruct the browser not to open a download directly in the browser but instead to provide only the Save option. The user has to first save it and then open it in an application.
10
+
11
+
::alert{type="info"}
12
+
ℹ Read more about this header [here](https://webtechsurvey.com/response-header/x-download-options).
13
+
::
14
+
15
+
## Usage
16
+
17
+
This header is enabled by default but you can change its behavior like following.
18
+
19
+
```ts
20
+
exportdefaultdefineNuxtConfig({
21
+
// Global
22
+
security: {
23
+
headers: {
24
+
xDownloadOptions: <OPTIONS>,
25
+
},
26
+
},
27
+
28
+
// Per route
29
+
routeRules: {
30
+
'/custom-route': {
31
+
headers: {
32
+
'X-Download-Options': <OPTIONS>
33
+
},
34
+
}
35
+
}
36
+
})
37
+
```
38
+
39
+
You can also disable this header by `xDownloadOptions: false`.
40
+
41
+
## Default value
42
+
43
+
By default, Nuxt Security will set following value for this header.
44
+
45
+
```http
46
+
X-Download-Options: noopen
47
+
```
48
+
49
+
## Available values
50
+
51
+
The `xDownloadOptions` header can be configured with following values.
52
+
53
+
```ts
54
+
xDownloadOptions: 'noopen'|false;
55
+
```
56
+
57
+
### `noopen`
58
+
59
+
When this directive is used, the user can still save and open the file, but this way the malicious code will be prevented from running on our website. Though it will run on the user’s file system.
:badge[Enabled]{type="success"} Smaller but still important security response headers.
4
+
5
+
---
6
+
7
+
:ellipsis{right=0pxwidth=75%blur=150px}
8
+
9
+
The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a `<frame>`, `<iframe>`, `<embed>` or `<object>`. Sites can use this to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites.
10
+
11
+
::alert{type="info"}
12
+
ℹ Read more about this header [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).
13
+
::
14
+
15
+
## Usage
16
+
17
+
This header is enabled by default but you can change its behavior like following.
18
+
19
+
```ts
20
+
exportdefaultdefineNuxtConfig({
21
+
// Global
22
+
security: {
23
+
headers: {
24
+
xFrameOptions: <OPTIONS>,
25
+
},
26
+
},
27
+
28
+
// Per route
29
+
routeRules: {
30
+
'/custom-route': {
31
+
headers: {
32
+
'X-Frame-Options': <OPTIONS>
33
+
},
34
+
}
35
+
}
36
+
})
37
+
```
38
+
39
+
You can also disable this header by `xFrameOptions: false`.
40
+
41
+
## Default value
42
+
43
+
By default, Nuxt Security will set following value for this header.
44
+
45
+
```http
46
+
X-Frame-Options: SAMEORIGIN
47
+
```
48
+
49
+
## Available values
50
+
51
+
The `xFrameOptions` header can be configured with following values.
52
+
53
+
```ts
54
+
xFrameOptions: 'DENY'|'SAMEORIGIN'|false;
55
+
```
56
+
57
+
### `DENY`
58
+
59
+
The page cannot be displayed in a frame, regardless of the site attempting to do so.
60
+
61
+
### `SAMEORIGIN`
62
+
63
+
The page can only be displayed if all ancestor frames are same origin to the page itself.
0 commit comments