Description
Adds an explicitly configured baseline of browser response protections. Empty policy strings omit their fields. HSTS is disabled by default and must only be enabled for an application intentionally deployed over TLS.
App_Context
type App_Context is limited private;
Call
procedure Call
(Context : in out App_Context;
X : in out Flyology.HTTP.Server.Applications.Exchange;
Next : in out Components.Next_Handler)
Security-header middleware component.
Parameters
- Context
Typed application context
- X
Borrowed request exchange
- Next
Borrowed downstream continuation
Components
with package Components is new
Flyology.HTTP.Server.Middleware (App_Context);
Content_Security_Policy
Content_Security_Policy : String := "";
Enable_HSTS
Enable_HSTS : Boolean := False;
Frame_Options
Frame_Options : String := "SAMEORIGIN";
HSTS_Value
HSTS_Value : String := "max-age=31536000";
Permissions_Policy
Permissions_Policy : String := "";
Referrer_Policy
Referrer_Policy : String := "strict-origin-when-cross-origin";