Configure security headers¶

The docs path serves an interactive "try it" console, so by default Register wraps both the docs and spec handlers with go/transport's conservative security-header middleware:

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none'
• Referrer-Policy: no-referrer
• HSTS off (enable it deliberately for HTTPS deployments)

You get this with no configuration:

openapi.Register(mux, spec) // security headers applied by default

Customise the headers¶

Pass go/transport/http SecurityHeadersOption values through WithSecurityHeaderOptions:

import transporthttp "gitlab.com/phpboyscout/go/transport/http"

openapi.Register(mux, spec,
    openapi.WithSecurityHeaderOptions(
        transporthttp.WithHSTS(/* … */),
        // any other transport/http SecurityHeadersOption
    ),
)

The options are forwarded verbatim to transporthttp.SecurityHeadersMiddleware, so the full transport header policy is available — see the go/transport docs.

Opt out¶

If an outer middleware chain already sets equivalent headers, disable the built-in wrapper so headers are not set twice:

openapi.Register(mux, spec, openapi.WithoutSecurityHeaders())