iph-security-headers

Reusable Express middleware for common HTTP security headers.

What it does

This library sets common response headers such as:

• X-Content-Type-Options
• X-Frame-Options
• Referrer-Policy
• X-XSS-Protection
• Strict-Transport-Security

Basic usage

import express from "express";
import { createSecurityHeaders } from "iph-security-headers";

const app = express();
app.use(createSecurityHeaders());

Custom configuration example

app.use(
  createSecurityHeaders({
    frameOptions: "SAMEORIGIN",
    referrerPolicy: "no-referrer",
    hsts: "max-age=31536000; includeSubDomains",
  }),
);

Options

• hsts: Strict-Transport-Security value.
• frameOptions: X-Frame-Options value.
• referrerPolicy: Referrer-Policy value.
• xssProtection: X-XSS-Protection value.
• contentTypeOptions: X-Content-Type-Options value.

Implementation notes

• Place this near the top of your middleware stack.
• Use HSTS only when HTTPS is enabled for your deployment.
• This library complements helmet, but does not replace a full CSP strategy by itself.