@middy/http-security-headers 7.2.2 → 7.3.0

package/index.d.ts

@@ -58,4 +58,8 @@ declare function httpSecurityHeaders(
 	options?: WithBoolValues<Options>,
 ): middy.MiddlewareObj<unknown, unknown, Error>;
 
+export declare function httpSecurityHeadersValidateOptions(
+	options?: Record<string, unknown>,
+): void;
+
 export default httpSecurityHeaders;

package/index.js

@@ -1,6 +1,36 @@
 // Copyright 2017 - 2026 will Farrell, Luciano Mammino, and Middy contributors.
 // SPDX-License-Identifier: MIT
-import { normalizeHttpResponse } from "@middy/util";
+import { normalizeHttpResponse, validateOptions } from "@middy/util";
+
+// Each policy option accepts either a config object or a boolean (true = use
+// defaults, false = disable). See middleware body for enable/disable logic.
+const objectOrBoolean = (v) =>
+	typeof v === "boolean" ||
+	(v !== null && typeof v === "object" && !Array.isArray(v));
+
+const optionSchema = {
+	contentSecurityPolicy: objectOrBoolean,
+	contentSecurityPolicyReportOnly: "boolean?",
+	contentTypeOptions: objectOrBoolean,
+	crossOriginEmbedderPolicy: objectOrBoolean,
+	crossOriginOpenerPolicy: objectOrBoolean,
+	crossOriginResourcePolicy: objectOrBoolean,
+	dnsPrefetchControl: objectOrBoolean,
+	downloadOptions: objectOrBoolean,
+	frameOptions: objectOrBoolean,
+	originAgentCluster: objectOrBoolean,
+	permissionsPolicy: objectOrBoolean,
+	permittedCrossDomainPolicies: objectOrBoolean,
+	poweredBy: "boolean?",
+	referrerPolicy: objectOrBoolean,
+	reportingEndpoints: objectOrBoolean,
+	reportTo: objectOrBoolean,
+	strictTransportSecurity: objectOrBoolean,
+	xssProtection: objectOrBoolean,
+};
+
+export const httpSecurityHeadersValidateOptions = (options) =>
+	validateOptions("@middy/http-security-headers", optionSchema, options);
 
 // Code and Defaults heavily based off https://helmetjs.github.io/
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@middy/http-security-headers",
-	"version": "7.2.2",
+	"version": "7.3.0",
 	"description": "Applies best practice security headers to responses. It's a simplified port of HelmetJS",
 	"type": "module",
 	"engines": {
@@ -17,9 +17,6 @@
 			"import": {
 				"types": "./index.d.ts",
 				"default": "./index.js"
-			},
-			"require": {
-				"default": "./index.js"
 			}
 		}
 	},
@@ -68,10 +65,10 @@
 		"url": "https://github.com/sponsors/willfarrell"
 	},
 	"dependencies": {
-		"@middy/util": "7.2.2"
+		"@middy/util": "7.3.0"
 	},
 	"devDependencies": {
-		"@middy/core": "7.2.2",
+		"@middy/core": "7.3.0",
 		"@types/aws-lambda": "^8.0.0",
 		"@types/node": "^22.0.0"
 	}