security-headers-builder

HTTP security headers generator and validator for Node.js. Build recommended security headers (CSP, HSTS, X-Frame-Options, etc.) or validate existing ones.

Install

npm install security-headers-builder

Quick Start

import { buildHeaders } from 'security-headers-builder';

const headers = buildHeaders({ preset: 'balanced' });

// Use with Express
app.use((req, res, next) => {
  Object.entries(headers).forEach(([key, value]) => res.setHeader(key, value));
  next();
});

API

buildHeaders(options?)

Returns a record of header names to values.

| Option | Description | |--------|-------------| | preset | 'strict' | 'balanced' | 'permissive' | | csp | Custom CSP directives (merged with preset) | | hstsMaxAge | HSTS max-age in seconds (default: 31536000) | | hstsIncludeSubDomains | Include subdomains in HSTS | | hstsPreload | Add preload directive |

validateHeaders(headers)

Validates existing headers against best practices. Returns { valid, issues }.

License

MIT