README.md

Documentation: github.com/gin-contrib/secure

     1# Secure
     2
     3[![Build Status](https://travis-ci.org/gin-contrib/secure.svg)](https://travis-ci.org/gin-contrib/secure)
     4[![codecov](https://codecov.io/gh/gin-contrib/secure/branch/master/graph/badge.svg)](https://codecov.io/gh/gin-contrib/secure)
     5[![Go Report Card](https://goreportcard.com/badge/github.com/gin-contrib/secure)](https://goreportcard.com/report/github.com/gin-contrib/secure)
     6[![GoDoc](https://godoc.org/github.com/gin-contrib/secure?status.svg)](https://godoc.org/github.com/gin-contrib/secure)
     7
     8Secure middleware for [Gin](https://github.com/gin-gonic/gin/) framework.
     9
    10## Example
    11
    12See the [example1](example/code1/example.go), [example2](example/code2/example.go).
    13
    14DefaultConfig returns a Configuration with strict security settings
    15
    16[embedmd]:# (secure.go go /func DefaultConfig/ /^}$/)
    17```go
    18func DefaultConfig() Config {
    19	return Config{
    20		SSLRedirect:           true,
    21		IsDevelopment:         false,
    22		STSSeconds:            315360000,
    23		STSIncludeSubdomains:  true,
    24		FrameDeny:             true,
    25		ContentTypeNosniff:    true,
    26		BrowserXssFilter:      true,
    27		ContentSecurityPolicy: "default-src 'self'",
    28		IENoOpen:              true,
    29		SSLProxyHeaders:       map[string]string{"X-Forwarded-Proto": "https"},
    30	}
    31}
    32```
    33
    34[embedmd]:# (example/code1/example.go go)
    35```go
    36package main
    37
    38import (
    39	"github.com/gin-contrib/secure"
    40	"github.com/gin-gonic/gin"
    41)
    42
    43func main() {
    44	router := gin.Default()
    45
    46	router.Use(secure.New(secure.Config{
    47		AllowedHosts:          []string{"example.com", "ssl.example.com"},
    48		SSLRedirect:           true,
    49		SSLHost:               "ssl.example.com",
    50		STSSeconds:            315360000,
    51		STSIncludeSubdomains:  true,
    52		FrameDeny:             true,
    53		ContentTypeNosniff:    true,
    54		BrowserXssFilter:      true,
    55		ContentSecurityPolicy: "default-src 'self'",
    56		IENoOpen:              true,
    57		ReferrerPolicy:        "strict-origin-when-cross-origin",
    58		SSLProxyHeaders:       map[string]string{"X-Forwarded-Proto": "https"},
    59	}))
    60
    61	router.GET("/ping", func(c *gin.Context) {
    62		c.String(200, "pong")
    63	})
    64
    65	// Listen and Server in 0.0.0.0:8080
    66	router.Run()
    67}
    68```
View as plain text