implement headers with routeRules

[danielroe]

It feels like you could implement setting various headers with routeRules - e.g. a default value imposed via:

export default defineNuxtConfig({
  routeRules: {
    '/**': {
      // default headers
    }
  }
})

That way they could also be overridden with other route rules.

Moreover, it would be good to configure cors in the same way, and for the same reason. As a heads-up, likely future cors enhancements are anticipated directly within nitro.

[Baroshem]

I will implement the route roules the way you recommended but for cors I will leave it for now as it was quite a recent feature :)

Later on I will reconfigure the cors to work similar way

[maxdzin]

Hi @Baroshem!

I wondering about the possibility to apply the headers rules per route (for example, contentSecurityPolicy).
For current nuxt-security v0.13.0 it seems not possible. But maybe you can advise on how to do that?

[Baroshem]

Hey @maxdzin

It is possible.

Take a look at this example file https://github.com/Baroshem/nuxt-security/blob/main/playground/nuxt.config.ts

export default defineNuxtConfig({
  modules: ['nuxt-security'],

  // Per route configuration
  routeRules: {
    'secret': {
      headers: {
        'X-XSS-Protection': '1' // Here you need to pass 'Content-Security-Policy': 'your values here'
      },
    },
  },
})

[maxdzin]

Hi @Baroshem!

OK, thank you! So it seems the headers are supported (I didn't yet check that under the hood).

Then at least its declaration needs to be updated, because there's a TS error:

Object literal may only specify known properties, and 'headers' does not exist in type

The route rules don't include headers:

interface NuxtSecurityRouteRules {
    requestSizeLimiter?: RequestSizeLimiter | false;
    rateLimiter?: RateLimiter | false;
    xssValidator?: XssValidator | false;
    corsHandler?: CorsOptions | false;
    allowedMethodsRestricter: AllowedHTTPMethods | false;
}

So cannot go further since typecheck error.

[Baroshem]

@maxdzin

Ah I see. You are correct. Could you please create a new issue with this type bug?

If you have some time and would like to contribute, the PR will be more than welcome :)

[maxdzin]

@Baroshem Ok, sure. I'll create a PR then.

[maxdzin]

@Baroshem here's the issue + question there:
#151