@lacspace/headers

Secure HTTP headers & a typed Content-Security-Policy builder.

A tiny, framework-agnostic Helmet: strict security response headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, COOP) and a typed CSP builder. Get a plain headers object for Express/Hono/Fastify, or a Next.js headers() config.

• 🛡️ securityHeaders() — sensible strict defaults
• 🧱 csp() / strictCsp() — typed Content-Security-Policy
• ▲ toNextHeaders() for next.config headers()
• ⚡ Zero dependencies · 🌍 isomorphic · fully typed

Install

npm install @lacspace/headers

Usage

import { securityHeaders, csp } from "@lacspace/headers";

const headers = securityHeaders({
  contentSecurityPolicy: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "https://cdn.example.com"],
    imgSrc: ["'self'", "data:", "https:"],
    upgradeInsecureRequests: true,
  },
});
// { "Strict-Transport-Security": "max-age=15552000; includeSubDomains",
//   "X-Content-Type-Options": "nosniff", "X-Frame-Options": "SAMEORIGIN",
//   "Referrer-Policy": "strict-origin-when-cross-origin", "Content-Security-Policy": "…" }

// apply in any framework
for (const [k, v] of Object.entries(headers)) res.setHeader(k, v);

Next.js

// next.config.js
import { toNextHeaders } from "@lacspace/headers";
export default { async headers() { return toNextHeaders({ contentSecurityPolicy: { defaultSrc: ["'self'"] } }); } };

API

| Export | Description | | --- | --- | | securityHeaders(opts?) | headers object with strict defaults | | csp(directives) | typed → CSP string | | strictCsp(overrides?) | a strict baseline CSP | | toNextHeaders(opts?, source?) | Next.js headers() array |

The Lacspace Security Kit

| Package | For | | --- | --- | | @lacspace/crypto | AES encryption & hashing | | @lacspace/password | Password hashing | | @lacspace/jwt | JWTs & tokens | | @lacspace/apikey | API keys | | @lacspace/otp | TOTP/HOTP 2FA | | @lacspace/webauthn | Passkeys / biometric | | @lacspace/mfa | 2FA/3FA orchestration | | @lacspace/lock | Account lockout | | @lacspace/headers | Secure headers / CSP (this package) | | @lacspace/redact | Log redaction |

New in 1.1 — CSP nonces & adapters

import { generateNonce, strictCsp, applyHeaders, expressSecurityHeaders } from "@lacspace/headers";

// Per-request nonce → drop 'unsafe-inline', allow only your own inline scripts/styles
const nonce = generateNonce();
const policy = strictCsp({}, { nonce });      // adds 'nonce-…' to script-src & style-src
// …render <script nonce={nonce}> and set Content-Security-Policy: policy

// Fetch / edge — set all security headers on a Response
export function GET() { return applyHeaders(new Response("ok")); }

// Express
app.use(expressSecurityHeaders({ hstsPreload: true }));

Licensing

This package is free under the Lacspace Free Licence — MIT-equivalent freedoms. Use it in personal and commercial projects at no cost; just keep the notice.

Not every Lacspace package is free. We also offer Commercial (paid), Client-specific, and Private (proprietary) packages under separate terms. See the full Lacspace Licence Centre.

Part of the Lacspace ecosystem — 35 zero-dependency, isomorphic TypeScript packages.

All packages ↗ · npm org ↗ · Licence Centre ↗ · GitHub ↗