OptionalcontentSecurityPolicy
contentSecurityPolicy?:
| string
| { directives?: Record<string, string | string[]> }
OptionalpermissionsPolicy
permissionsPolicy?: Record<string, string[]>
OptionalreferrerPolicy
referrerPolicy?:
| false
| "no-referrer"
| "no-referrer-when-downgrade"
| "origin"
| "origin-when-cross-origin"
| "same-origin"
| "strict-origin"
| "strict-origin-when-cross-origin"
| "unsafe-url"
OptionalstrictTransportSecurity
strictTransportSecurity?: {
includeSubDomains?: boolean;
maxAge?: number;
preload?: boolean;
}
OptionalxContentTypeOptions
xContentTypeOptions?: boolean
OptionalxFrameOptions
xFrameOptions?: string | false
OptionalxXssProtection
xXssProtection?: boolean
falseturns the default (SAMEORIGIN) off;undefinedkeeps it.