Helmet

import "github.com/go-mizu/mizu/middlewares/helmet"

app := mizu.New()

// Use recommended security headers
app.Use(helmet.Default())

// Recommended settings for most applications
app.Use(helmet.Default())

X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1

app.Use(helmet.ContentSecurityPolicy(
    "default-src 'self'; " +
    "script-src 'self' 'unsafe-inline' cdn.example.com; " +
    "style-src 'self' 'unsafe-inline'; " +
    "img-src 'self' data: https:; " +
    "font-src 'self' fonts.gstatic.com",
))

app.Use(helmet.StrictTransportSecurity(
    365*24*time.Hour, // 1 year
    true,             // include subdomains
    true,             // preload
))

// Prevent any framing
app.Use(helmet.XFrameOptions("DENY"))

// Allow same origin only
app.Use(helmet.XFrameOptions("SAMEORIGIN"))

app.Use(helmet.New(helmet.Options{
    ContentSecurityPolicy: "default-src 'self'",
    XFrameOptions:         "DENY",
    XContentTypeOptions:   true,
    ReferrerPolicy:        "no-referrer",
    StrictTransportSecurity: &helmet.HSTSOptions{
        MaxAge:            365 * 24 * time.Hour,
        IncludeSubDomains: true,
        Preload:           true,
    },
    PermissionsPolicy:             "geolocation=(), microphone=()",
    CrossOriginOpenerPolicy:       "same-origin-allow-popups",
    CrossOriginEmbedderPolicy:     "require-corp",
    CrossOriginResourcePolicy:     "same-site",
}))

// Apply only specific headers
app.Use(helmet.XContentTypeOptions())      // X-Content-Type-Options: nosniff
app.Use(helmet.XFrameOptions("DENY"))       // X-Frame-Options: DENY
app.Use(helmet.ReferrerPolicy("no-referrer"))
app.Use(helmet.OriginAgentCluster())

// Disable dangerous browser features
app.Use(helmet.PermissionsPolicy(
    "geolocation=(), " +
    "microphone=(), " +
    "camera=(), " +
    "payment=(self), " +
    "usb=()",
))

// Enable DNS prefetching for performance
on := true
app.Use(helmet.XDNSPrefetchControl(true))

// Disable for privacy
app.Use(helmet.XDNSPrefetchControl(false))

app.Use(helmet.New(helmet.Options{
    // Isolate browsing context
    CrossOriginOpenerPolicy: "same-origin",

    // Require CORP for subresources
    CrossOriginEmbedderPolicy: "require-corp",

    // Control resource sharing
    CrossOriginResourcePolicy: "same-origin",
}))

// Default creates middleware with recommended headers
func Default() mizu.Middleware

// New creates middleware with custom options
func New(opts Options) mizu.Middleware

func ContentSecurityPolicy(policy string) mizu.Middleware
func XFrameOptions(value string) mizu.Middleware
func XContentTypeOptions() mizu.Middleware
func ReferrerPolicy(policy string) mizu.Middleware
func StrictTransportSecurity(maxAge time.Duration, includeSubDomains, preload bool) mizu.Middleware
func PermissionsPolicy(policy string) mizu.Middleware
func CrossOriginOpenerPolicy(policy string) mizu.Middleware
func CrossOriginEmbedderPolicy(policy string) mizu.Middleware
func CrossOriginResourcePolicy(policy string) mizu.Middleware
func OriginAgentCluster() mizu.Middleware
func XDNSPrefetchControl(on bool) mizu.Middleware
func XDownloadOptions() mizu.Middleware
func XPermittedCrossDomainPolicies(policy string) mizu.Middleware

// Development: Report-only mode
app.Use(helmet.New(helmet.Options{
    ContentSecurityPolicy: "default-src 'self'; report-uri /csp-report",
}))

// Production: Enforce
app.Use(helmet.New(helmet.Options{
    ContentSecurityPolicy: "default-src 'self'",
}))