https://github.com/mridang/traefik-superheader

A traefik plugin to add the most common headers to HTTP requests
https://github.com/mridang/traefik-superheader

headers http-headers middleware owasp security traefik traefik-middleware traefik-plugin

Last synced: 3 months ago
JSON representation

A traefik plugin to add the most common headers to HTTP requests

Host: GitHub
URL: https://github.com/mridang/traefik-superheader
Owner: mridang
License: apache-2.0
Created: 2025-02-06T04:18:50.000Z (11 months ago)
Default Branch: master
Last Pushed: 2025-09-08T03:36:32.000Z (4 months ago)
Last Synced: 2025-10-10T22:32:12.057Z (3 months ago)
Topics: headers, http-headers, middleware, owasp, security, traefik, traefik-middleware, traefik-plugin
Language: Go
Homepage: https://plugins.traefik.io/plugins/67b83299b48ad97c67d7ecc3/superheader-plugin
Size: 370 KB
Stars: 0
Watchers: 1
Forks: 0
Open Issues: 4
Metadata Files:
- Readme: README.md
- License: LICENSE

Awesome Lists containing this project

README

# Superheader - OWASP Headers for Traefik

**Superheader** is a plugin for Traefik that adds the necessary headers
to responses to help secure web applications.

The headers set are adhere to the recommendations of the OWASP Secure Headers
Project https://owasp.org/www-project-secure-headers/

##### Why ?

While there is third-party middleware for almost all frameworks e.g. Helmet for
Express (Node) and Spring Security for Spring (Java), using this
middleware make it simple to secure all your web applications.

## Usage

For a plugin to be active for a given Traefik instance, it must be declared in
the static configuration.

```yaml
experimental:
plugins:
superheader:
moduleName: "github.com/mridang/traefik-superheader"
version: "v1.0.0"
```

##### Example 1: Traefik Configuration Using YAML

```yaml
http:
routers:
my-router:
rule: "Host(`example.com`)"
entryPoints:
- web
middlewares:
- my-middleware # Apply the middleware to the router

middlewares:
superheader:
plugin:
superheader:
x-frame-options: DENY
x-dns-prefetch-control: off
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: no-referrer
x-xss-protection: 1; mode=block
cross-origin-opener-policy: same-origin
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
x-permitted-cross-domain-policies: master-only
remove-powered-by: on
```

##### Example 2: Traefik Configuration Using CLI Args

This example shows you how to load and configure the plugin using the command-line
arguments.

```shell
traefik \
--entryPoints.web.address=:80 \
--providers.file.filename=traefik.yml \
--experimental.plugins.superheader.moduleName=github.com/mridang/traefik-superheader \
--experimental.plugins.superheader.version=v0.1.0 \
--http.middlewares.superheader.plugin.superheader.x-frame-options=DENY \
--http.middlewares.superheader.plugin.superheader.x-dns-prefetch-control=off \
--http.middlewares.superheader.plugin.superheader.x-content-type-options=nosniff \
--http.middlewares.superheader.plugin.superheader.strict-transport-security="max-age=31536000; includeSubDomains" \
--http.middlewares.superheader.plugin.superheader.referrer-policy=no-referrer \
--http.middlewares.superheader.plugin.superheader.x-xss-protection="1; mode=block" \
--http.middlewares.superheader.plugin.superheader.cross-origin-opener-policy=same-origin \
--http.middlewares.superheader.plugin.superheader.cross-origin-embedder-policy=require-corp \
--http.middlewares.superheader.plugin.superheader.cross-origin-resource-policy=same-origin \
--http.middlewares.superheader.plugin.superheader.origin-agent-cluster="?1" \
--http.middlewares.superheader.plugin.superheader.x-permitted-cross-domain-policies=master-only \
--http.middlewares.superheader.plugin.superheader.remove-powered-by=on
```

##### Example 3: Usage in Docker Compose

```yaml
services:
traefik:
image: traefik:3.3.3
ports:
- "7080:80"
command:
- --api.dashboard=false
- --api.insecure=false
- --log.level=DEBUG
- --experimental.plugins.superheader.moduleName=github.com/mridang/traefik-superheader
- --providers.docker=true
- --entrypoints.web.address=:80
volumes:
- '/var/run/docker.sock:/var/run/docker.sock'
labels:
- traefik.enable=true
- traefik.http.services.traefik.loadbalancer.server.port=8080

# A sample service that uses the middleware with the defaults
foo:
image: traefik/whoami
labels:
- traefik.enable=true
- traefik.http.routers.foo.rule=PathPrefix(`/foo`)
- traefik.http.routers.foo.middlewares=securefoo
- traefik.http.middlewares.securefoo.plugin.superheader=true
- traefik.http.routers.foo.entrypoints=web

# A sample service that uses the middleware with custom options
bar:
image: traefik/whoami
labels:
- traefik.enable=true
- traefik.http.routers.bar.rule=PathPrefix(`/bar`)
- traefik.http.routers.bar.middlewares=securebar
- traefik.http.middlewares.securebar.plugin.superheader.x-frame-options="DENY"
- traefik.http.routers.bar.entrypoints=web

# A sample service that does not use the middleware at all
baz:
image: traefik/whoami
labels:
- traefik.enable=true
- traefik.http.routers.baz.rule=PathPrefix(`/baz`)
- traefik.http.routers.baz.entrypoints=web
```

Once the middleware has been installed, you can test the security of your web
application using the test suite on MDN https://observatory.mozilla.org/

### Options

The middleware exposes a few options to allow customising the behaviour. To make
it harder to misconfigure the plugin all the keys and values are lowercased. All
the values are case-insensitive.

#### Configuring the X-Frame-Options Header

This header can be configured by the "x-frame-options" header to control whether
a browser should be allowed to render a page in a ``, ``,
``, or ``.