Edda.Security

Security header policy helpers.

create_app applies SecurityHeadersDefaults automatically. Applications can opt out with SecurityHeadersNone, provide a custom policy, or wrap a subtree explicitly with use_security_headers.

Types

FrameOptions

type FrameOptions =
  | FrameDeny
  | FrameSameOrigin
  deriving (Debug, Eq)

Frame embedding policy for X-Frame-Options.

HstsConfig

record HstsConfig {
  max_age: Int,
  include_subdomains: Bool,
  preload: Bool
}
  deriving (Debug, Eq)

Strict Transport Security policy.

SecurityHeadersConfig

record SecurityHeadersConfig {
  content_type_options: Bool,
  frame_options: Maybe FrameOptions,
  referrer_policy: Maybe String,
  hsts: Maybe HstsConfig
}
  deriving (Debug, Eq)

Security headers emitted by use_security_headers.

UseSecurityHeadersConfig

type UseSecurityHeadersConfig =
  | SecurityHeadersNone
  | SecurityHeadersDefaults
  | SecurityHeadersCustom SecurityHeadersConfig
  deriving (Debug, Eq)

App-level security header policy.

Functions

default_hsts_config

fun default_hsts_config : HstsConfig

Default HSTS policy for HTTPS apps that explicitly opt in.

default_security_headers_config

fun default_security_headers_config : SecurityHeadersConfig

Conservative default security headers.

HSTS is disabled by default because it is an HTTPS deployment policy.

apply_security_headers_config

fun apply_security_headers_config : UseSecurityHeadersConfig -> Response -> Response

Apply the configured app-level security header policy to a response.

use_security_headers

fun use_security_headers : SecurityHeadersConfig -> Request -> Response needs {..e} -> Request -> Response needs {..e}

Add security headers to a handler's response.

apply_security_headers

fun apply_security_headers : SecurityHeadersConfig -> Response -> Response

Add security headers to a response, without replacing existing headers.