Security Headers

securityHeaders() stamps security headers on every HTTP flow response — successes, failures, and short-circuits alike, because it runs at onResponse, the last pipeline stage. An explicit value your app already set is never overridden unless you ask for it.

Quick start

import { oke } from "okengine";
import { securityHeaders } from "okengine/plugins";

export const app = oke({ name: "shop", env: "dev" }).plug(securityHeaders());

Every HTTP response now carries:

Helmet parity

Every helmet.js middleware maps to an option here — same defaults wherever helmet's default is safe for an API, plus three deliberate deviations marked opt-in:

Beyond parity: headers land on failures too (helmet middleware ordering bugs are a classic Express footgun), app-set values win by default, and every option can be driven live from the database (below).

Options

.plug(
  securityHeaders({
    contentSecurityPolicy: {
      directives: { scriptSrc: ["'self'", "https://cdn.example.com"] }, // merged over the defaults
      reportOnly: true, // Content-Security-Policy-Report-Only while you tune
    },
    hsts: { maxAge: 63072000, includeSubDomains: true },
    permissionsPolicy: "camera=(), microphone=()",
  }),
)

Runtime configuration

Header policy is exactly the config you want to flip without a redeploy — enable HSTS the day HTTPS lands, tighten the CSP after an audit. Pass a configSource() and options follow the database within one sync interval:

const headers = configSource({
  plugin: "security-headers",
  code: { hsts: false }, // safe floor for local dev
  db: { store: db },
  kv: cache,
});
on(every("30s"), headers.sync());
export const app = oke({ name: "shop", env: "dev" }).plug(securityHeaders(headers));

INSERT INTO security_headers_config ("key", "value")
VALUES ('config', '{"hsts": true}');

See Plugins → Runtime configuration for the full contract.

Notes

Next