veryfront/security

Import

import {
  applyCORSHeaders,
  applyCORSHeadersSync,
  applyCsrfCookie,
  applySecurityHeaders,
  buildCacheControl,
  cors,
} from "veryfront/security";

Examples

Apply response security headers

import { applySecurityHeaders, generateNonce } from "veryfront/security";

const response = new Response("Ready");
applySecurityHeaders(response.headers, false, generateNonce(), null);

Exports

Components

Name	Description	Source
`BUILD_HELPER_PERMISSIONS`	BUILD_HELPER - manifest generators, framework source prep. Only needs filesystem + env access.	source
`CACHE_DURATIONS`		source
`CommonSchemas`	Lazy-getter object that preserves the `CommonSchemas.email` call shape. Each access returns the cached `Schema<T>` (memoized inside `defineSchema`), so chained calls like `CommonSchemas.email.parse(x)` work as before.	source
`CORS_MAX_AGE`		source
`DEFAULT_CORS_HEADERS`		source
`DEFAULT_CORS_METHODS`		source
`DEFAULT_LIMITS`	Framework-owned request limits.	source
`INPUT_VALIDATION_FAILED`	HTTP request input validation failures (replaces ValidationError)	source
`PathValidationError`		source
`SECURITY_VIOLATION`	Path traversal / secure-fs violations (replaces SecurityError)	source
`SERVER_PERMISSIONS`	SERVER - CLI server (dev, production, proxy, MCP, split-mode). Also used by build and test tasks that need equivalent access.	source
`ValidationPresets`		source
`WORKFLOW_RUN_PERMISSIONS`	WORKFLOW_RUN - `ProcessRunExecutor` (RESTRICTED). Runs user-authored code - no `--allow-run`, `--allow-ffi`, or `--allow-sys`.	source

Functions

Name	Description	Source
`applyCORSHeaders`		source
`applyCORSHeadersSync`	Apply CORS synchronously. Promise-returning values still fail closed at runtime.	source
`applyCsrfCookie`	Set CSRF cookie on GET/HEAD responses when not already present. Uses httpOnly: false so client JS can read the cookie for double-submit.	source
`applySecurityHeaders`		source
`buildCacheControl`		source
`cors`	Create CORS middleware.	source
`corsSimple`		source
`createResponseBuilder`		source
`createSecureFs`		source
`createValidatedHandler`	Create a validated API handler with bounded body/query validation. Bodies without a schema are preflighted through a clone, leaving the original request body available to the handler after its size is verified.	source
`createValidationError`	Create an input validation error. Convenience wrapper around INPUT_VALIDATION_FAILED.create().	source
`createValidator`		source
`generateCsrfToken`	Generate a CSRF token and return value + Set-Cookie header string	source
`generateNonce`		source
`getSecurityHeader`		source
`handleCORSPreflight`		source
`isPreflightRequest`		source
`isRequestBodyTooLargeError`		source
`isValidSecurityConfig`	Check a standalone security configuration against the canonical project configuration schema.	source
`loadSecurityConfig`	Load the project’s schema-validated security configuration.	source
`parseFormData`	Parse and validate multipart or URL-encoded form data.	source
`parseJsonBody`	Parse and validate a JSON request body.	source
`parseQueryParams`	Parse and validate query parameters from a bounded request URL.	source
`readBodyWithLimit`		source
`sanitizeData`	Sanitize JSON-like data by HTML-encoding string values and removing keys that can mutate an object’s prototype chain.	source
`sanitizePathForDisplay`		source
`setCors`		source
`shouldApplyCORS`		source
`validateCORSConfig`	Validate CORS configuration for security issues.	source
`validateCsrf`	Validate CSRF token by comparing header and cookie	source
`validateLexicalPath`	Validate lexical path containment without consulting a filesystem.	source
`validateOrigin`	Validate origin against CORS configuration.	source
`validateOriginSync`	Synchronous origin validation. Promise-returning values still fail closed at runtime.	source
`validatePath`	Admit a path against the physical semantics of a runtime filesystem.	source
`validatePathSync`	Validate lexical path containment without consulting a filesystem.	source
`validateRequestLimits`		source
`wrapAdapterWithSecurity`		source

Classes

Name	Description	Source
`AuthHandler`		source
`BaseHandler`		source
`CsrfHandler`		source
`ResponseBuilder`		source
`SecureFs`		source
`SecurityConfigLoader`		source

Types

Name	Description	Source
`CacheStrategy`		source
`CORSConfig`		source
`CORSHeaderOptions`		source
`CORSOptions`	CORS policy accepted by asynchronous middleware and preflight APIs.	source
`CORSPreflightOptions`		source
`CORSValidationResult`		source
`CSPDirectives`		source
`CsrfConfig`		source
`CsrfTokenOptions`		source
`HandlerHelpers`		source
`LexicalPathValidationOptions`	Options for lexical containment checks that never inspect a filesystem.	source
`OriginValidator`		source
`ParseFormOptions`		source
`ParseJsonOptions`		source
`ParseQueryOptions`		source
`PathValidationPolicyOptions`	Filesystem-independent policy fields shared by physical path presets.	source
`RequestLimits`		source
`ResponseBuilderConfig`		source
`SecureFsConfig`		source
`SecurityConfig`		source
`SecurityContext`		source
`SecurityEvent`		source
`SyncCORSConfig`	CORS policy accepted by synchronous response-building APIs.	source
`SyncCORSHeaderOptions`	Header options accepted by synchronous CORS response helpers.	source
`SyncOriginValidator`		source
`ValidatedData`		source
`ValidatedHandlerConfig`	Configuration for `createValidatedHandler()`.	source
`ValidatedHandlerFunction`	Handler signature that receives validated request data.	source
`ValidationLevel`		source
`ValidationOptions`	Options for physical filesystem admission.	source
`ValidationResult`		source

Getting Started

Concepts

Guides

API Reference

veryfront/security

Import

Examples

Apply response security headers

Exports

Components

Functions

Classes

Types

​Import

​Examples

​Apply response security headers

​Exports

​Components

​Functions

​Classes

​Types

Import

Examples

Apply response security headers

Exports

Components

Functions

Classes

Types