Skip to content

Latest commit

 

History

History
45 lines (41 loc) · 1.36 KB

configuration.md

File metadata and controls

45 lines (41 loc) · 1.36 KB
Raw

Configuration

next-safe allows you to configure every header that it generates. Most config options may be set to false to disable the feature. Here are the default values for all config options.

nextSafe({
	contentTypeOptions: "nosniff",
	contentSecurityPolicy: {
		"base-uri": "'none'",
		"child-src": "'none'",
		"connect-src": "'self'",
		"default-src": "'self'",
		"font-src": "'self'",
		"form-action": "'self'",
		"frame-ancestors": "'none'",
		"frame-src": "'none'",
		"img-src": "'self'",
		"manifest-src": "'self'",
		"media-src": "'self'",
		"object-src": "'none'",
		"prefetch-src": "'self'",
		"script-src": "'self'",
		"style-src": "'self'",
		"worker-src": "'self'",
		mergeDefaultDirectives: false,
		reportOnly: false,
	},
	frameOptions: "DENY",
	permissionsPolicy: {},
	permissionsPolicyDirectiveSupport: ["proposed", "standard"],
	isDev: false,
	referrerPolicy: "no-referrer",
	xssProtection: "1; mode=block",
})

For more information on each of these options, check out their documentation: