Secure Headers

Secure Headers

STUB: This skill is not yet implemented

This placeholder preserves the documented plugin structure. See parent plugin README for planned capabilities.

Planned Capabilities

• Content-Security-Policy (CSP): Script, style, and resource origin restrictions
• HSTS: Strict-Transport-Security enforcement
• X-Frame-Options: Clickjacking prevention
• X-Content-Type-Options: MIME type sniffing prevention
• SameSite Cookies: CSRF protection via cookie attributes
• Framework-specific implementation guides (Next.js, Express, etc.)

Critical Pattern

// next.config.js
module.exports = {
  async headers() {
    return [{
      source: '/(.*)',
      headers: [
        { key: 'X-Frame-Options', value: 'DENY' },
        { key: 'X-Content-Type-Options', value: 'nosniff' },
        { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' },
        { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self' 'unsafe-inline'" }
      ]
    }];
  }
};

Implementation Status

• Core implementation
• References documentation
• Output templates
• Integration tests