@middy/http-security-headers 7.2.3 → 7.3.1

package/index.d.ts

@@ -58,4 +58,8 @@ declare function httpSecurityHeaders(
 	options?: WithBoolValues<Options>,
 ): middy.MiddlewareObj<unknown, unknown, Error>;
 
+export declare function httpSecurityHeadersValidateOptions(
+	options?: Record<string, unknown>,
+): void;
+
 export default httpSecurityHeaders;

package/index.js

@@ -1,6 +1,104 @@
 // Copyright 2017 - 2026 will Farrell, Luciano Mammino, and Middy contributors.
 // SPDX-License-Identifier: MIT
-import { normalizeHttpResponse } from "@middy/util";
+import { normalizeHttpResponse, validateOptions } from "@middy/util";
+
+// Each policy option accepts either a config object or a boolean (true = use
+// defaults, false = disable). See middleware body for enable/disable logic.
+
+const booleanOr = (objectSchema) => ({
+	oneOf: [{ type: "boolean" }, objectSchema],
+});
+
+const policyObject = (policyEnum) => ({
+	type: "object",
+	properties: {
+		policy: policyEnum
+			? { type: "string", enum: policyEnum }
+			: { type: "string" },
+	},
+	additionalProperties: false,
+});
+
+const actionObject = {
+	type: "object",
+	properties: {
+		action: { type: "string" },
+	},
+	additionalProperties: false,
+};
+
+const referrerPolicyValues = [
+	"no-referrer",
+	"no-referrer-when-downgrade",
+	"origin",
+	"origin-when-cross-origin",
+	"same-origin",
+	"strict-origin",
+	"strict-origin-when-cross-origin",
+	"unsafe-url",
+];
+
+const permittedCrossDomainPoliciesValues = [
+	"none",
+	"master-only",
+	"by-content-type",
+	"by-ftp-filename",
+	"all",
+];
+
+const optionSchema = {
+	type: "object",
+	properties: {
+		// CSP directives are an open-ended string map; keep permissive.
+		contentSecurityPolicy: booleanOr({ type: "object" }),
+		contentSecurityPolicyReportOnly: { type: "boolean" },
+		contentTypeOptions: booleanOr(actionObject),
+		crossOriginEmbedderPolicy: booleanOr(policyObject()),
+		crossOriginOpenerPolicy: booleanOr(policyObject()),
+		crossOriginResourcePolicy: booleanOr(policyObject()),
+		dnsPrefetchControl: booleanOr({
+			type: "object",
+			properties: {
+				allow: { type: "boolean" },
+			},
+			additionalProperties: false,
+		}),
+		downloadOptions: booleanOr(actionObject),
+		frameOptions: booleanOr(actionObject),
+		originAgentCluster: booleanOr({
+			type: "object",
+			additionalProperties: false,
+		}),
+		// Permissions-Policy features are an open-ended string map.
+		permissionsPolicy: booleanOr({ type: "object" }),
+		permittedCrossDomainPolicies: booleanOr(
+			policyObject(permittedCrossDomainPoliciesValues),
+		),
+		poweredBy: { type: "boolean" },
+		referrerPolicy: booleanOr(policyObject(referrerPolicyValues)),
+		// Reporting-Endpoints is an open-ended group->url map.
+		reportingEndpoints: booleanOr({ type: "object" }),
+		// Report-To groups are open-ended; maxAge/includeSubdomains are known.
+		reportTo: booleanOr({ type: "object" }),
+		strictTransportSecurity: booleanOr({
+			type: "object",
+			properties: {
+				maxAge: { type: "number", minimum: 0 },
+				includeSubDomains: { type: "boolean" },
+				preload: { type: "boolean" },
+			},
+			additionalProperties: false,
+		}),
+		xssProtection: booleanOr({
+			type: "object",
+			additionalProperties: false,
+		}),
+	},
+	additionalProperties: false,
+};
+
+export const httpSecurityHeadersValidateOptions = (options) =>
+	validateOptions("@middy/http-security-headers", optionSchema, options);
 
 // Code and Defaults heavily based off https://helmetjs.github.io/
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@middy/http-security-headers",
-	"version": "7.2.3",
+	"version": "7.3.1",
 	"description": "Applies best practice security headers to responses. It's a simplified port of HelmetJS",
 	"type": "module",
 	"engines": {
@@ -17,9 +17,6 @@
 			"import": {
 				"types": "./index.d.ts",
 				"default": "./index.js"
-			},
-			"require": {
-				"default": "./index.js"
 			}
 		}
 	},
@@ -68,10 +65,10 @@
 		"url": "https://github.com/sponsors/willfarrell"
 	},
 	"dependencies": {
-		"@middy/util": "7.2.3"
+		"@middy/util": "7.3.1"
 	},
 	"devDependencies": {
-		"@middy/core": "7.2.3",
+		"@middy/core": "7.3.1",
 		"@types/aws-lambda": "^8.0.0",
 		"@types/node": "^22.0.0"
 	}