transport-security
Transport and host security
Three middleware harden requests in transit. Add them to the middleware stack.
SSL enforcement
MVC::Keayl::Middleware::SSL redirects plain requests to HTTPS and adds an HSTS
header to secure responses. A GET or HEAD redirect uses 301; other verbs
use 307 so the method is preserved.
MVC::Keayl::Middleware::SSL.new(
app => $inner,
hsts => True, # default
hsts-max-age => 31536000,
include-subdomains => True,
preload => False,
);The request scheme is taken from X-Forwarded-Proto when present, so it works
behind a TLS-terminating proxy.
Host authorization
MVC::Keayl::Middleware::HostAuthorization blocks requests whose Host is not on
an allowlist, returning 403. An entry may be an exact host, a leading-dot
domain that matches its subdomains, or a regex. An empty allowlist permits any
host.
MVC::Keayl::Middleware::HostAuthorization.new(
app => $inner,
allowed => ['example.com', '.example.com', /\.internal$/],
);Secure response headers
MVC::Keayl::Middleware::SecureHeaders adds default security headers without
overriding any the application already set: X-Frame-Options: SAMEORIGIN,
X-Content-Type-Options: nosniff, X-XSS-Protection: 0,
X-Permitted-Cross-Domain-Policies: none, and
Referrer-Policy: strict-origin-when-cross-origin.
also adds or overrides headers; set one to Nil to drop a default:
MVC::Keayl::Middleware::SecureHeaders.new(
app => $inner,
also => %( 'Content-Security-Policy' => "default-src 'self'", 'X-XSS-Protection' => Nil ),
);