> ## Documentation Index > Fetch the complete documentation index at: https://veryfront.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # veryfront/security > Security layer - input validation with size limits, CORS configuration, CSP and security headers, path traversal prevention, and secure filesystem access. ## Import ```ts theme={null} import { applyCORSHeaders, applyCORSHeadersSync, applyCsrfCookie, applySecurityHeaders, buildCacheControl, cors, } from "veryfront/security"; ``` ## Examples ### Apply response security headers ```ts theme={null} import { applySecurityHeaders, generateNonce } from "veryfront/security"; const response = new Response("Ready"); applySecurityHeaders(response.headers, false, generateNonce(), null); ``` ## Exports ### Components | Name | Description | Source | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | `BUILD_HELPER_PERMISSIONS` | BUILD\_HELPER - manifest generators, framework source prep. Only needs filesystem + env access. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/deno-permissions.ts#L48) | | `CACHE_DURATIONS` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/constants.ts#L10) | | `CommonSchemas` | Lazy-getter object that preserves the `CommonSchemas.email` call shape. Each access returns the cached `Schema` (memoized inside `defineSchema`), so chained calls like `CommonSchemas.email.parse(x)` work as before. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/schemas/common.ts#L91) | | `CORS_MAX_AGE` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/constants.ts#L22) | | `DEFAULT_CORS_HEADERS` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/constants.ts#L9) | | `DEFAULT_CORS_METHODS` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/constants.ts#L1) | | `DEFAULT_LIMITS` | Framework-owned request limits. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L21) | | `INPUT_VALIDATION_FAILED` | HTTP request input validation failures (replaces ValidationError) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/errors/error-registry/general.ts#L86) | | `PathValidationError` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L39) | | `SECURITY_VIOLATION` | Path traversal / secure-fs violations (replaces SecurityError) | [source](https://github.com/veryfront/veryfront-code/blob/main/src/errors/error-registry/general.ts#L77) | | `SERVER_PERMISSIONS` | SERVER - CLI server (dev, production, proxy, MCP, split-mode). Also used by build and test tasks that need equivalent access. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/deno-permissions.ts#L14) | | `ValidationPresets` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/presets.ts#L45) | | `WORKFLOW_RUN_PERMISSIONS` | WORKFLOW\_RUN - `ProcessRunExecutor` (RESTRICTED). Runs user-authored code - no `--allow-run`, `--allow-ffi`, or `--allow-sys`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/deno-permissions.ts#L37) | ### Functions | Name | Description | Source | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------- | | `applyCORSHeaders` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/headers.ts#L86) | | `applyCORSHeadersSync` | Apply CORS synchronously. Promise-returning values still fail closed at runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/headers.ts#L112) | | `applyCsrfCookie` | Set CSRF cookie on GET/HEAD responses when not already present. Uses httpOnly: false so client JS can read the cookie for double-submit. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L150) | | `applySecurityHeaders` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/security-handler.ts#L445) | | `buildCacheControl` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/cache-handler.ts#L86) | | `cors` | Create CORS middleware. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/middleware.ts#L10) | | `corsSimple` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/middleware.ts#L39) | | `createResponseBuilder` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/builder.ts#L58) | | `createSecureFs` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L1144) | | `createValidatedHandler` | Create a validated API handler with bounded body/query validation. Bodies without a schema are preflighted through a clone, leaving the original request body available to the handler after its size is verified. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L208) | | `createValidationError` | Create an input validation error. Convenience wrapper around INPUT\_VALIDATION\_FAILED.create(). | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/errors.ts#L12) | | `createValidator` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L446) | | `generateCsrfToken` | Generate a CSRF token and return value + Set-Cookie header string | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L70) | | `generateNonce` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/security-handler.ts#L71) | | `getSecurityHeader` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/security-handler.ts#L432) | | `handleCORSPreflight` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/preflight.ts#L126) | | `isPreflightRequest` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/preflight.ts#L186) | | `isRequestBodyTooLargeError` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/limits.ts#L100) | | `isValidSecurityConfig` | Check a standalone security configuration against the canonical project configuration schema. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/config.ts#L222) | | `loadSecurityConfig` | Load the project's schema-validated security configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/config.ts#L242) | | `parseFormData` | Parse and validate multipart or URL-encoded form data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L139) | | `parseJsonBody` | Parse and validate a JSON request body. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L68) | | `parseQueryParams` | Parse and validate query parameters from a bounded request URL. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/parsers.ts#L195) | | `readBodyWithLimit` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/limits.ts#L229) | | `sanitizeData` | Sanitize JSON-like data by HTML-encoding string values and removing keys that can mutate an object's prototype chain. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/sanitizers.ts#L8) | | `sanitizePathForDisplay` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L468) | | `setCors` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/middleware/cors-handler.ts#L4) | | `shouldApplyCORS` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/headers.ts#L130) | | `validateCORSConfig` | Validate CORS configuration for security issues. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/validators.ts#L418) | | `validateCsrf` | Validate CSRF token by comparing header and cookie | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L119) | | `validateLexicalPath` | Validate lexical path containment without consulting a filesystem. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L403) | | `validateOrigin` | Validate origin against CORS configuration. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/validators.ts#L392) | | `validateOriginSync` | Synchronous origin validation. Promise-returning values still fail closed at runtime. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/validators.ts#L408) | | `validatePath` | Admit a path against the physical semantics of a runtime filesystem. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L330) | | `validatePathSync` | Validate lexical path containment without consulting a filesystem. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/index.ts#L431) | | `validateRequestLimits` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/limits.ts#L106) | | `wrapAdapterWithSecurity` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L1203) | ### Classes | Name | Description | Source | | ---------------------- | ----------- | ---------------------------------------------------------------------------------------------------------- | | `AuthHandler` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/auth.ts#L161) | | `BaseHandler` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/base-handler.ts#L45) | | `CsrfHandler` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/csrf/csrf-handler.ts#L60) | | `ResponseBuilder` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/builder.ts#L9) | | `SecureFs` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L645) | | `SecurityConfigLoader` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/config.ts#L292) | ### Types | Name | Description | Source | | ------------------------------ | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | | `CacheStrategy` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/types.ts#L11) | | `CORSConfig` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/middleware/types.ts#L1) | | `CORSHeaderOptions` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L34) | | `CORSOptions` | CORS policy accepted by asynchronous middleware and preflight APIs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L7) | | `CORSPreflightOptions` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L27) | | `CORSValidationResult` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L21) | | `CSPDirectives` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/middleware/types.ts#L10) | | `CsrfConfig` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L20) | | `CsrfTokenOptions` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/csrf/helpers.ts#L27) | | `HandlerHelpers` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/base-handler.ts#L19) | | `LexicalPathValidationOptions` | Options for lexical containment checks that never inspect a filesystem. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L33) | | `OriginValidator` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L2) | | `ParseFormOptions` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L39) | | `ParseJsonOptions` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L28) | | `ParseQueryOptions` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L43) | | `PathValidationPolicyOptions` | Filesystem-independent policy fields shared by physical path presets. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L18) | | `RequestLimits` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L8) | | `ResponseBuilderConfig` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/response/types.ts#L27) | | `SecureFsConfig` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L56) | | `SecurityConfig` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/types/server.ts#L9) | | `SecurityContext` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L39) | | `SecurityEvent` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/secure-fs.ts#L65) | | `SyncCORSConfig` | CORS policy accepted by synchronous response-building APIs. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L17) | | `SyncCORSHeaderOptions` | Header options accepted by synchronous CORS response helpers. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L42) | | `SyncOriginValidator` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/http/cors/types.ts#L1) | | `ValidatedData` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/types.ts#L47) | | `ValidatedHandlerConfig` | Configuration for `createValidatedHandler()`. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L11) | | `ValidatedHandlerFunction` | Handler signature that receives validated request data. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/input-validation/handler.ts#L18) | | `ValidationLevel` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L8) | | `ValidationOptions` | Options for physical filesystem admission. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L28) | | `ValidationResult` | | [source](https://github.com/veryfront/veryfront-code/blob/main/src/security/path-validation/types.ts#L10) |