Superheader - OWASP Headers for Traefik

Superheader is a plugin for Traefik that adds the necessary headers to responses to help secure web applications.

The headers set are adhere to the recommendations of the OWASP Secure Headers Project https://owasp.org/www-project-secure-headers/

Why ?

While there is third-party middleware for almost all frameworks e.g. Helmet for Express (Node) and Spring Security for Spring (Java), using this middleware make it simple to secure all your web applications.

Usage

For a plugin to be active for a given Traefik instance, it must be declared in the static configuration.

experimental:
  plugins:
    superheader:
      moduleName: "github.com/mridang/traefik-superheader"
      version: "v1.0.0"

Example 1: Traefik Configuration Using YAML

http:
  routers:
    my-router:
      rule: "Host(`example.com`)"
      entryPoints:
        - web
      middlewares:
        - my-middleware  # Apply the middleware to the router

middlewares:
  superheader:
    plugin:
      superheader:
        x-frame-options: DENY
        x-dns-prefetch-control: off
        x-content-type-options: nosniff
        strict-transport-security: max-age=31536000; includeSubDomains
        referrer-policy: no-referrer
        x-xss-protection: 1; mode=block
        cross-origin-opener-policy: same-origin
        cross-origin-embedder-policy: require-corp
        cross-origin-resource-policy: same-origin
        origin-agent-cluster: ?1
        x-permitted-cross-domain-policies: master-only
        remove-powered-by: on

Example 2: Traefik Configuration Using CLI Args

This example shows you how to load and configure the plugin using the command-line arguments.

traefik \
  --entryPoints.web.address=:80 \
  --providers.file.filename=traefik.yml \
  --experimental.plugins.superheader.moduleName=github.com/mridang/traefik-superheader \
  --experimental.plugins.superheader.version=v0.1.0 \
  --http.middlewares.superheader.plugin.superheader.x-frame-options=DENY \
  --http.middlewares.superheader.plugin.superheader.x-dns-prefetch-control=off \
  --http.middlewares.superheader.plugin.superheader.x-content-type-options=nosniff \
  --http.middlewares.superheader.plugin.superheader.strict-transport-security="max-age=31536000; includeSubDomains" \
  --http.middlewares.superheader.plugin.superheader.referrer-policy=no-referrer \
  --http.middlewares.superheader.plugin.superheader.x-xss-protection="1; mode=block" \
  --http.middlewares.superheader.plugin.superheader.cross-origin-opener-policy=same-origin \
  --http.middlewares.superheader.plugin.superheader.cross-origin-embedder-policy=require-corp \
  --http.middlewares.superheader.plugin.superheader.cross-origin-resource-policy=same-origin \
  --http.middlewares.superheader.plugin.superheader.origin-agent-cluster="?1" \
  --http.middlewares.superheader.plugin.superheader.x-permitted-cross-domain-policies=master-only \
  --http.middlewares.superheader.plugin.superheader.remove-powered-by=on

Example 3: Usage in Docker Compose

services:
  traefik:
    image: traefik:3.3.3
    ports:
      - "7080:80"
    command:
      - --api.dashboard=false
      - --api.insecure=false
      - --log.level=DEBUG
      - --experimental.plugins.superheader.moduleName=github.com/mridang/traefik-superheader
      - --providers.docker=true
      - --entrypoints.web.address=:80
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
    labels:
      - traefik.enable=true
      - traefik.http.services.traefik.loadbalancer.server.port=8080

  # A sample service that uses the middleware with the defaults
  foo:
    image: traefik/whoami
    labels:
      - traefik.enable=true
      - traefik.http.routers.foo.rule=PathPrefix(`/foo`)
      - traefik.http.routers.foo.middlewares=securefoo
      - traefik.http.middlewares.securefoo.plugin.superheader=true
      - traefik.http.routers.foo.entrypoints=web

  # A sample service that uses the middleware with custom options
  bar:
    image: traefik/whoami
    labels:
      - traefik.enable=true
      - traefik.http.routers.bar.rule=PathPrefix(`/bar`)
      - traefik.http.routers.bar.middlewares=securebar
      - traefik.http.middlewares.securebar.plugin.superheader.x-frame-options="DENY"
      - traefik.http.routers.bar.entrypoints=web

  # A sample service that does not use the middleware at all
  baz:
    image: traefik/whoami
    labels:
      - traefik.enable=true
      - traefik.http.routers.baz.rule=PathPrefix(`/baz`)
      - traefik.http.routers.baz.entrypoints=web

Once the middleware has been installed, you can test the security of your web application using the test suite on MDN https://observatory.mozilla.org/

Options

The middleware exposes a few options to allow customising the behaviour. To make it harder to misconfigure the plugin all the keys and values are lowercased. All the values are case-insensitive.

Configuring the X-Frame-Options Header

This header can be configured by the "x-frame-options" header to control whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object>.