SecurityHeadersPlugin Schema

Schema definition for the Security Headers Plugin, which adds essential security HTTP headers to protect against common web vulnerabilities.

Schema Information

Properties

Usage Examples

Basic Security Headers (Recommended Defaults)

<tr itemscope itemtype="https://rustybeam.net/schema/SecurityHeadersPlugin">
    <span itemprop="library">file://./plugins/librusty_beam_security_headers.so</span>
</tr>

Strict Security Configuration

<tr itemscope itemtype="https://rustybeam.net/schema/SecurityHeadersPlugin">
    <span itemprop="library">file://./plugins/librusty_beam_security_headers.so</span>
    <span itemprop="csp_policy">default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'</span>
    <span itemprop="hsts_max_age">63072000</span>
    <span itemprop="hsts_include_subdomains">true</span>
    <span itemprop="hsts_preload">true</span>
    <span itemprop="frame_options">DENY</span>
    <span itemprop="referrer_policy">no-referrer</span>
</tr>

API-focused Security

<tr itemscope itemtype="https://rustybeam.net/schema/SecurityHeadersPlugin">
    <span itemprop="library">file://./plugins/librusty_beam_security_headers.so</span>
    <span itemprop="csp_policy">default-src 'none'; frame-ancestors 'none'</span>
    <span itemprop="frame_options">DENY</span>
    <span itemprop="content_type_options">true</span>
    <span itemprop="referrer_policy">no-referrer</span>
    <span itemprop="name">api_security</span>
</tr>

Development-friendly Configuration

<tr itemscope itemtype="https://rustybeam.net/schema/SecurityHeadersPlugin">
    <span itemprop="library">file://./plugins/librusty_beam_security_headers.so</span>
    <span itemprop="csp_policy">default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https:</span>
    <span itemprop="hsts_max_age">0</span>
    <span itemprop="frame_options">SAMEORIGIN</span>
    <span itemprop="name">dev_security</span>
</tr>

Advanced Permissions Policy

<tr itemscope itemtype="https://rustybeam.net/schema/SecurityHeadersPlugin">
    <span itemprop="library">file://./plugins/librusty_beam_security_headers.so</span>
    <span itemprop="permissions_policy">camera=(), microphone=(), geolocation=(), payment=()</span>
    <span itemprop="referrer_policy">strict-origin-when-cross-origin</span>
</tr>

Security Headers Generated

Content Security Policy (CSP) Guidelines

Common CSP Directives

CSP Security Levels

HSTS Configuration

HSTS Deployment Strategy

1. Start Small: max-age=300 (5 minutes) for testing
2. Increase Gradually: max-age=86400 (1 day) after testing
3. Production: max-age=31536000 (1 year) with subdomains
4. Preload: Add preload directive for maximum security

HSTS Examples

# Testing
Strict-Transport-Security: max-age=300

# Development
Strict-Transport-Security: max-age=86400; includeSubDomains

# Production
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Schema Inheritance

This schema inherits from the UtilityPlugin schema, which provides:

• logfile - Log file path
• directory - Directory configuration
• enabled - Plugin enable/disable state

And ultimately from the base Plugin schema, which provides:

• library - Plugin library path
• plugin - Base plugin reference property

Security Best Practices

Progressive Security Enhancement

1. Phase 1: Basic headers (Content-Type-Options, Frame-Options)
2. Phase 2: Referrer Policy and basic CSP
3. Phase 3: HSTS with short max-age
4. Phase 4: Strict CSP and full HSTS
5. Phase 5: Permissions Policy and HSTS preload

Validation Rules

• hsts_max_age must be a non-negative integer (0 disables HSTS)
• frame_options must be one of: "DENY", "SAMEORIGIN", or "ALLOW-FROM uri"
• content_type_options must be "true" or "false" if specified
• referrer_policy must be a valid referrer policy value
• csp_policy should be a valid Content Security Policy directive
• permissions_policy should follow Permissions Policy syntax
• The name property should be unique if multiple security header plugins are used

Common Security Header Values

Referrer Policy Options

• no-referrer - Never send referrer information
• origin - Send only origin (no path/query)
• strict-origin - Send origin only for same-protocol requests
• strict-origin-when-cross-origin - Full URL for same-origin, origin only for cross-origin
• same-origin - Full URL for same-origin only

Permissions Policy Examples

# Disable all features
camera=(), microphone=(), geolocation=(), payment=()

# Allow for same origin only
camera=(self), microphone=(self)

# Allow for specific origins
camera=(self "https://trusted.example.com")

# Mixed permissions
camera=(), microphone=(self), geolocation=(self "https://maps.example.com")

Testing Security Headers

Browser Developer Tools

# Check headers in browser console
console.log(document.querySelectorAll('*').length); // Should work with proper CSP
console.log(document.domain); // Check HSTS enforcement

Online Security Scanners

• Mozilla Observatory: https://observatory.mozilla.org/
• Security Headers: https://securityheaders.com/
• CSP Evaluator: https://csp-evaluator.withgoogle.com/
• HSTS Preload: https://hstspreload.org/

Command Line Testing

# Check headers with curl
curl -I https://example.com/

# Test CSP enforcement
curl -H "Content-Security-Policy-Report-Only: default-src 'self'" https://example.com/

# Verify HSTS
curl -I -H "Host: example.com" http://example.com/

Integration with Other Plugins

• CORS Plugin: Works together for comprehensive security
• File Handler Plugin: Security headers applied to all served content
• Compression Plugin: Should be placed before compression
• Access Log Plugin: Logs security header responses
• Redirect Plugin: Can redirect HTTP to HTTPS for HSTS compliance

Troubleshooting

See Also

• UtilityPlugin Schema - Parent schema
• Security Headers Plugin Documentation - Complete plugin documentation
• CorsPlugin Schema - CORS security integration
• RedirectPlugin Schema - HTTPS redirect integration