LacspaceLacspace Developer
← All packages

@lacspace/headers

v1.1.3Security Kit0 deps

Secure HTTP headers & a typed Content-Security-Policy builder — HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy. Framework-agnostic + Next.js. Zero-dependency, isomorphic.

npm i @lacspace/headers
View on npm ↗GitHub ↗

Usage

headers.ts
import { securityHeaders, csp } from "@lacspace/headers";

const headers = securityHeaders({
  contentSecurityPolicy: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "https://cdn.example.com"],
    imgSrc: ["'self'", "data:", "https:"],
    upgradeInsecureRequests: true,
  },
});
// { "Strict-Transport-Security": "max-age=15552000; includeSubDomains",
//   "X-Content-Type-Options": "nosniff", "X-Frame-Options": "SAMEORIGIN",
//   "Referrer-Policy": "strict-origin-when-cross-origin", "Content-Security-Policy": "…" }

// apply in any framework
for (const [k, v] of Object.entries(headers)) res.setHeader(k, v);

Exports 7

applyHeaderscspexpressSecurityHeadersgenerateNoncesecurityHeadersstrictCsptoNextHeaders

Keywords

security-headerscspcontent-security-policyhstshelmethttp-headers

More in Security Kit

@lacspace/apikey

Issue & verify API keys the right way — prefixed high-entropy keys, store only the SHA-256 hash, constant-time verify, last-4 display. Isomorphic over Web Crypto.

@lacspace/crypto

Safe, boring cryptography over Web Crypto — authenticated AES-256-GCM, PBKDF2 key derivation, SHA-256, HMAC, secure random and constant-time compare. Isomorphic (Node, edge, browser, RN).

@lacspace/jwt

JSON Web Tokens (HS256/384/512) with strict expiry/issuer/audience checks + secure random & CSRF tokens. Isomorphic over Web Crypto — Node, edge, browser.

@lacspace/lock

Account lockout & brute-force protection (server lock) — N-strikes, exponential backoff, self-resetting window, pluggable store. Zero-dependency, isomorphic.

@lacspace/mfa

Orchestrate multi-factor auth — combine password + TOTP + passkeys into 2FA/3FA step-up flows with NIST assurance levels (AAL). Zero-dependency (bar @lacspace/otp), isomorphic.

@lacspace/otp

TOTP & HOTP two-factor auth, Google Authenticator compatible — generate secrets, compute/verify codes and build otpauth:// QR URIs. Built on Web Crypto: runs on Node, edge and browser. Zero-dependency, isomorphic.

← Browse all 76 packagesRead the handbook