Arcjet Nosecone: security headers for JS frameworks

Arcjet Nosecone is an open source library that helps set security headers such as Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), and X-Content-Type-Options in JS applications built with Bun, Deno, Next.js, Node.js, or SvelteKit.

What are Arcjet utilities?

Arcjet utilities are independent libraries that do not require the use of the main Arcjet SDK - they can be used with or without other Arcjet rules.

We take the pain out of implementing security tasks through these utilities to provide a security as code approach to developer-first security.

Supported headers

Nosecone helps you add and configure these headers:

• Content-Security-Policy (CSP)
• Cross-Origin-Embedder-Policy (COEP)
• Cross-Origin-Opener-Policy
• Cross-Origin-Resource-Policy
• Origin-Agent-Cluster
• Referrer-Policy
• Strict-Transport-Security (HSTS)
• X-Content-Type-Options
• X-DNS-Prefetch-Control
• X-Download-Options
• X-Frame-Options
• X-Permitted-Cross-Domain-Policies
• X-XSS-Protection

For full details on each option, see the reference guide.

Note

If you are using Express, NestJS, or Remix we recommend using the excellent Helmet library, which informed much of our work on Nosecone.

Quick start

This guide shows you how to add our recommended default security headers.

1. Install Nosecone

In your project root, install the Arcjet Nosecone library for your framework:

2. Configure your application

3. Run your application

4. Inspect the headers

The default headers apply a pragmatic set of security headers to your application, but may break things (particularly the CSP header).

We recommend you test your application thoroughly and tweak the settings to ensure it continues to work as expected.

What next?

Nosecone reference Details about each security header and how to configure them.

Explore

Arcjet can protect your entire app or individual routes with a few lines of code. Using the main Arcjet SDK you can set up bot protection, rate limiting for your API, minimize fraudulent registrations with the signup form protection and more.

Example apps See the example apps.

Learn how Arcjet works Arcjet's architecture.

SDK reference Python SDK reference guide.

Get help

Need help with anything? Email support@arcjet.com to get support from our engineering team, join our Discord, or open an issue on GitHub.

Discussion