koa-helmet ​

const Koa = require('koa');
const helmet = require('koa-helmet');

const app = new Koa();

// 注册中间件
app.use(helmet());

app.use(async (ctx) => {
  ctx.body = { message: '已启用安全头' };
});

app.listen(3000);

const Koa = require('koa');
const helmet = require('koa-helmet');

const app = new Koa();

app.use(helmet({
  // 配置内容安全策略 (CSP)
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", 'data:', 'https:']
    }
  },

  // 防止点击劫持
  frameguard: {
    action: 'deny'
  },

  // 隐藏 X-Powered-By
  hidePoweredBy: true,

  // 强制 HTTPS
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true
  },

  // 防止 XSS 攻击
  xssFilter: true,

  // 防止 MIME 类型嗅探
  noSniff: true,

  // 禁止在 iframe 中加载
  referrerPolicy: { policy: 'same-origin' }
}));

app.use(async (ctx) => {
  ctx.body = { message: '已配置安全策略' };
});

app.listen(3000);