Applying hardened security headers (HSTS, CSP, X-Frame-Options, etc.) in a Next.js config or any server.
Overview
A tiny framework-agnostic Helmet: strict security response headers (HSTS, X-Frame-Options, Referrer-Policy, COOP) and a typed Content-Security-Policy builder. Works everywhere + Next.js.
Install
$ npm install @lacspace/headers
Quick example
@lacspace/headersts
securityHeaders({ contentSecurityPolicy })
Returns { HSTS, CSP, … }
Tips
`toNextHeaders()` returns the exact shape `next.config` expects — drop it into `async headers()`.
Tighten the CSP allowlist whenever you add a third-party script or font.
Zero-dependency and isomorphic — safe to import on the server, in the browser, on the edge and in React Native. It tree-shakes, so you only ship what you import.
Watch out for
A too-strict CSP can silently break inline scripts/styles — test in report-only mode first.
