Security Headers

import "github.com/thuongh2/go-security/web/middleware"

securityhttp.New(
    securityhttp.WithHeaders(
        middleware.WithFrameOptions("SAMEORIGIN"),     // instead of DENY
        middleware.WithContentTypeOptions(""),         // disable nosniff
        middleware.WithReferrerPolicy("same-origin"),  // instead of no-referrer
    ),
)

chain := middleware.New(
    middleware.SecurityHeaders(middleware.WithFrameOptions("")), // disable X-Frame-Options
)

securityhttp.New(
    securityhttp.WithHeaders(
        middleware.WithHSTS(
            31536000, // max-age in seconds (1 year)
            true,     // includeSubDomains
            true,     // preload
        ),
    ),
)

securityhttp.New(
    securityhttp.WithHeaders(
        middleware.WithCacheControlFor(middleware.Matcher("/account/**")),
    ),
)

// or, for every response:
securityhttp.New(
    securityhttp.WithHeaders(
        middleware.WithCacheControlAll(),
    ),
)

func withHeader(name, value string) middleware.Middleware {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            w.Header().Set(name, value)
            next.ServeHTTP(w, r)
        })
    }
}

chain := middleware.New(
    middleware.SecurityHeaders(),
    withHeader("Content-Security-Policy", "default-src 'self'; script-src 'self'"),
    withHeader("Permissions-Policy", "geolocation=(), microphone=(), camera=()"),
)