feat: allow configuring headers in runtime

playground/nuxt.config.ts

@@ -24,6 +24,7 @@ export default defineNuxtConfig({
     rateLimiter: {
       tokensPerInterval: 10,
       interval: 10000
-    }
+    },
+    runtimeHooks: true
   }
 })

playground/server/api/runtime-hooks.ts

@@ -0,0 +1,7 @@
+import { defineEventHandler } from "#imports"
+
+export default defineEventHandler((event) => {
+    return {
+        csp: getResponseHeader(event, 'Content-Security-Policy')
+    }
+})

playground/server/plugins/headers.ts

@@ -0,0 +1,10 @@
+
+export default defineNitroPlugin((nitroApp) => {
+    nitroApp.hooks.hook('nuxt-security:ready', () => {
+        nitroApp.hooks.callHook('nuxt-security:headers', '/api/runtime-hooks' ,{
+            contentSecurityPolicy: {
+                "script-src": ["'self'", "'unsafe-inline'"],
+            }
+        })
+    })
+})

src/module.ts

@@ -1,6 +1,6 @@
 import { fileURLToPath } from 'node:url'
 import { resolve, normalize } from 'pathe'
-import { defineNuxtModule, addServerHandler, installModule, addVitePlugin } from '@nuxt/kit'
+import { defineNuxtModule, addServerHandler, installModule, addVitePlugin, addServerPlugin } from '@nuxt/kit'
 import { defu } from 'defu'
 import type { Nuxt } from '@nuxt/schema'
 import viteRemove from 'unplugin-remove/vite'
@@ -19,7 +19,7 @@ import {
   defaultSecurityConfig
 } from './defaultConfig'
 import { SECURITY_MIDDLEWARE_NAMES } from './middlewares'
-import { type HeaderMapper, SECURITY_HEADER_NAMES, getHeaderValueFromOptions } from './headers'
+import { type HeaderMapper, SECURITY_HEADER_NAMES, getHeaderValueFromOptions } from './runtime/utils/headers'
 import sriHashes from './runtime/utils/sriHashes'
 
 declare module 'nuxt/schema' {
@@ -135,6 +135,15 @@ export default defineNuxtModule<ModuleOptions>({
       })
     }
 
+    if(nuxt.options.security.runtimeHooks) {
+      addServerPlugin(resolve(runtimeDir, 'nitro/plugins/00-context'))
+      addServerHandler({
+        handler: normalize(
+          resolve(runtimeDir, 'server/middleware/headers')
+        )
+      })
+    }
+
     const allowedMethodsRestricterConfig = nuxt.options.security
       .allowedMethodsRestricter
     if (

src/runtime/nitro/plugins/00-context.ts

@@ -0,0 +1,24 @@
+import { type HeaderMapper, getHeaderValueFromOptions, SECURITY_HEADER_NAMES } from "../../utils/headers"
+import { createRouter} from "radix3"
+import { defineNitroPlugin } from '#imports'
+
+export default defineNitroPlugin((nitroApp) => {
+    const router = createRouter()
+
+    nitroApp.hooks.hook('nuxt-security:headers', (route, headersConfig) => {
+        const headers: Record<string, string |false > = {}
+
+        for (const [header, headerOptions] of Object.entries(headersConfig)) {
+            headers[SECURITY_HEADER_NAMES[header]] = headerOptions === false ? false : getHeaderValueFromOptions(header as HeaderMapper, headerOptions as any)
+        }
+
+        router.insert(route, headers)
+    })
+
+    nitroApp.hooks.hook('request', (event) => {
+        event.context.security = event.context.security || {}
+        event.context.security.headers = router.lookup(event.path)
+    })
+
+    nitroApp.hooks.callHook('nuxt-security:ready')
+})

src/runtime/server/middleware/headers.ts

@@ -0,0 +1,13 @@
+import { defineEventHandler, setHeader, removeResponseHeader } from '#imports'
+
+export default defineEventHandler((event) => {
+    if(event.context.security.headers) {  
+        Object.entries(event.context.security.headers).forEach(([header, value]) => {
+            if(value === false) {
+                removeResponseHeader(event, header)
+            }else {
+                setHeader(event, header, value, )
+            }
+        }) 
+    }
+})

src/headers.ts → src/runtime/utils/headers.ts

@@ -1,8 +1,8 @@
-import {
+import type {
   ContentSecurityPolicyValue,
   PermissionsPolicyValue,
   StrictTransportSecurityValue
-} from './types/headers'
+} from '../../types/headers'
 
 type SecurityHeaderNames = Record<string, string>
 

src/types/index.ts

@@ -1,6 +1,5 @@
 import type { ModuleOptions as CsrfOptions } from 'nuxt-csurf'
 import type { Options as RemoveOptions } from 'unplugin-remove/types'
-
 import type { SecurityHeaders } from './headers'
 import type { AllowedHTTPMethods, BasicAuth, CorsOptions, RateLimiter, RequestSizeLimiter, XssValidator } from './middlewares'
 
@@ -23,6 +22,10 @@ export interface ModuleOptions {
   nonce: boolean;
   removeLoggers?: RemoveOptions | false;
   ssg?: Ssg;
+  /**
+   * enable runtime nitro hooks to configure some options at runtime
+   */
+  runtimeHooks: boolean;
   sri?: boolean
 }
 
@@ -34,3 +37,20 @@ export interface NuxtSecurityRouteRules {
   allowedMethodsRestricter?: AllowedHTTPMethods | false;
   nonce?: boolean;
 }
+
+export interface NuxtSecurityEventContext {
+  headers: Record<string, string | string[] | number | false> | null
+}
+
+declare module 'h3' {
+  interface H3EventContext {
+      security: NuxtSecurityEventContext
+  }
+}
+
+declare module 'nitropack' {
+  interface NitroRuntimeHooks {
+    'nuxt-security:headers': (route: string, headers: SecurityHeaders) => void
+    'nuxt-security:ready': () => void
+  }
+} 

test/fixtures/runtime-hooks/.nuxtrc

@@ -0,0 +1 @@
+imports.autoImport=true

test/fixtures/runtime-hooks/app.vue

@@ -0,0 +1,5 @@
+<template>
+  <div>
+    <NuxtPage />
+  </div>
+</template>

test/fixtures/runtime-hooks/nuxt.config.ts

@@ -0,0 +1,21 @@
+import MyModule from '../../../src/module'
+
+export default defineNuxtConfig({
+  modules: [
+    MyModule
+  ],
+  routeRules:{
+    '/test': {
+      headers: {
+        'x-xss-protection': '1',
+      }
+    }
+  },
+  security: {
+    nonce: false,
+    runtimeHooks: true,
+    headers: {
+      contentSecurityPolicy: false
+    }
+  }
+})

test/fixtures/runtime-hooks/package.json

@@ -0,0 +1,5 @@
+{
+  "private": true,
+  "name": "runtime-hooks",
+  "type": "module"
+}

test/fixtures/runtime-hooks/pages/index.vue

@@ -0,0 +1,3 @@
+<template>
+  <div>runtime hooks</div>
+</template>

test/fixtures/runtime-hooks/server/api/runtime-hooks.ts

@@ -0,0 +1,7 @@
+import { getResponseHeader } from "h3"
+
+export default defineEventHandler((event) => {
+    return {
+        csp: getResponseHeader(event, 'Content-Security-Policy')
+    }
+})

test/fixtures/runtime-hooks/server/plugins/headers.ts

@@ -0,0 +1,9 @@
+export default  defineNitroPlugin((nitroApp) => {
+    nitroApp.hooks.hook('nuxt-security:ready', () => {
+        nitroApp.hooks.callHook('nuxt-security:headers', '/api/runtime-hooks' ,{
+            contentSecurityPolicy: {
+                "script-src": ["'self'", "'unsafe-inline'", '*.azure.com'],
+            }
+        })
+    })
+})

test/runtime-hooks.test.ts

@@ -0,0 +1,19 @@
+import { fileURLToPath } from 'node:url'
+import { describe, it, expect } from 'vitest'
+import { setup, fetch } from '@nuxt/test-utils'
+
+await setup({
+    rootDir: fileURLToPath(new URL('./fixtures/runtime-hooks', import.meta.url))
+})
+
+describe('[nuxt-security] runtime hooks', () => {
+    it('expect csp to be set by a runtime hook', async () => {
+        const res = await fetch('/api/runtime-hooks')
+        expect(await res.json()).toMatchInlineSnapshot(`
+          {
+            "csp": "script-src 'self' 'unsafe-inline' *.azure.com",
+          }
+        `)
+        expect(res.headers.get('Content-Security-Policy')).toMatchInlineSnapshot( '"script-src \'self\' \'unsafe-inline\' *.azure.com"')
+    })
+})