Using Layer0’s EdgeJS to Configure Custom Security Headers

X-Frame-Options Header

The X-Frame-Options header indicates whether a browser should be allowed to render a page in a frame, iframe, embed or object tag(s) to avoid click-jacking attacks. Whether set to DENY or SAMEORIGIN ensures that their content is not embedded into other sites or only embedded into sites with the same origin, respectively. ‍

const { Router } = require(‘@layer0/core/router’) new Router() .get(“/:route”, ({ setResponseHeader }) => { setResponseHeader(“X-Frame-Options”, “SAMEORIGIN”) })

X-Frame-Options gives you the ability to:

1. Prevent Clickjacking attacks
2. Indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>

Cross-Origin Resource Policy (CORP)

CORP allows servers to protect against certain cross-origin or cross-site embedding of the requested resource (for e.g. API responses). It also prevents speculative side-channel attacks like Spectre.

const { Router } = require(‘@layer0/core/router’) new Router() .get(“/:route”, ({ setResponseHeader }) => { setResponseHeader(“Cross-Origin-Resource-Policy”, “same-origin”) })

Cross-Origin Resource Policy is an opt-in response header which can protect any resource; there is no need for browsers to sniff MIME types. — MDN Docs

Cross-Origin Embedder Policy (COEP)

COEP header prevents loading of cross-origin resources that have not been granted permission for (via CORS or CORP). Use ‘require-corp’ to enforce the header, while ‘unsafe-none’ to allow fetching cross-origin documents.

const { Router } = require(‘@layer0/core/router’) new Router() .get(“/:route”, ({ setResponseHeader }) => { setResponseHeader(“Cross-Origin-Embedder-Policy”, “require-corp”) })

Cross-Origin Opener Policy (COOP)

Enforcing COOP header ensures that a top-level document’s browsing context group is not shared between cross-origin documents. While ‘same-origin’ breaks the integrations that require cross-origin window interactions such as OAuth and Payment, ‘same-origin-allow-popups’ aims to share the context with only the popups from the SAMEORIGIN.

const { Router } = require(‘@layer0/core/router’) new Router() .get(“/:route”, ({ setResponseHeader }) => { setResponseHeader(“Cross-Origin-Opener-Policy”, “same-origin-allow-popups”) })

Referrer Policy

When a user navigates (clicking on a link) from one site (the origin) to another (the destination), the latter receives information about the origin the user came from. The Referrer-Policy header controls how much of this information shall be available to the destination. For all the directives of Referrer-Policy, refer to Referrer-Policy — HTTP | MDN (mozilla.org).

const { Router } = require(“@layer0/core/router”) module.exports= new Router() .get(“/”, ({ setResponseHeader }) => { setResponseHeader(“Referrer-Policy”, “origin-when-cross-origin”) })

Permissions Policy

An experimental HTTP Header that provides the ability to allow/deny browser features in its own frames, and in any iframe in the document. For all the directives of Referrer-Policy, refer to Feature-Policy — HTTP | MDN (mozilla.org)

const { Router } = require(“@layer0/core/router”) module.exports= new Router() .get(“/”, ({ setResponseHeader }) => { setResponseHeader( “Permissions-Policy”, “camera=(), microphone=(), geolocation=()” ); })

HTTP Strict Transport Security (HSTS)