/Superheader Plugin

Superheader Plugin

v1.0.4

Superheader - OWASP Headers for Traefik

Superheader is a plugin for Traefik that adds the necessary headers to responses to help secure web applications.

The headers set are adhere to the recommendations of the OWASP Secure Headers Project https://owasp.org/www-project-secure-headers/

Usage

For a plugin to be active for a given Traefik instance, it must be declared in the static configuration.

experimental:
  plugins:
    superheader:
      moduleName: "github.com/mridang/traefik-superheader"
      version: "v1.0.0"

Example 1: Traefik Configuration Using YAML

http:
  routers:
    my-router:
      rule: "Host(`example.com`)"
      entryPoints:
        - web
      middlewares:
        - my-middleware  # Apply the middleware to the router

middlewares:
  superheader:
    plugin:
      superheader:
        x-frame-options: DENY
        x-dns-prefetch-control: off
        x-content-type-options: nosniff
        strict-transport-security: max-age=31536000; includeSubDomains
        referrer-policy: no-referrer
        x-xss-protection: 1; mode=block
        cross-origin-opener-policy: same-origin
        cross-origin-embedder-policy: require-corp
        cross-origin-resource-policy: same-origin
        origin-agent-cluster: ?1
        x-permitted-cross-domain-policies: master-only
        remove-powered-by: on

Example 2: Traefik Configuration Using CLI Args

This example shows you how to load and configure the plugin using the command-line arguments.

traefik \
  --entryPoints.web.address=:80 \
  --providers.file.filename=traefik.yml \
  --experimental.plugins.superheader.moduleName=github.com/mridang/traefik-superheader \
  --experimental.plugins.superheader.version=v0.1.0 \
  --http.middlewares.superheader.plugin.superheader.x-frame-options=DENY \
  --http.middlewares.superheader.plugin.superheader.x-dns-prefetch-control=off \
  --http.middlewares.superheader.plugin.superheader.x-content-type-options=nosniff \
  --http.middlewares.superheader.plugin.superheader.strict-transport-security="max-age=31536000; includeSubDomains" \
  --http.middlewares.superheader.plugin.superheader.referrer-policy=no-referrer \
  --http.middlewares.superheader.plugin.superheader.x-xss-protection="1; mode=block" \
  --http.middlewares.superheader.plugin.superheader.cross-origin-opener-policy=same-origin \
  --http.middlewares.superheader.plugin.superheader.cross-origin-embedder-policy=require-corp \
  --http.middlewares.superheader.plugin.superheader.cross-origin-resource-policy=same-origin \
  --http.middlewares.superheader.plugin.superheader.origin-agent-cluster="?1" \
  --http.middlewares.superheader.plugin.superheader.x-permitted-cross-domain-policies=master-only \
  --http.middlewares.superheader.plugin.superheader.remove-powered-by=on

Example 3: Usage in Docker Compose

services:
  traefik:
    image: traefik:3.3.3
    ports:
      - "7080:80"
      - "9080:8080"
    command:
      - --api.dashboard=false
      - --api.insecure=false
      - --log.level=DEBUG
      - --providers.docker=true
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --experimental.plugins.superheader.moduleName=mridang/traefik-superheader
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
    labels:
      - traefik.enable=true
      - traefik.http.services.traefik.loadbalancer.server.port=8080

  # A sample service that uses the middleware with the defaults
  foo:
    image: traefik/whoami
    labels:
      - traefik.enable=true
      - traefik.http.routers.foo.rule=PathPrefix(`/foo`)
      - traefik.http.routers.foo.middlewares=superheader
      - traefik.http.routers.foo.entrypoints=websecure

  # A sample service that uses the middleware with custom options
  bar:
    image: traefik/whoami
    labels:
      - traefik.enable=true
      - traefik.http.routers.bar.rule=PathPrefix(`/bar`)
      - traefik.http.routers.bar.middlewares=superheader
      - traefik.http.middlewares.superheader.plugin.superheader.x-frame-options="DENY"
      - traefik.http.routers.bar.entrypoints=websecure

  # A sample service that does not use the middleware at all
  baz:
    image: traefik/whoami
    labels:
      - traefik.enable=true
      - traefik.http.routers.baz.rule=PathPrefix(`/baz`)
      - traefik.http.routers.baz.entrypoints=web

Options

The middleware exposes a few options to allow customising the behaviour. To make it harder to misconfigure the plugin all the keys and values are lowercased. All the values are case-insensitive.

Configuring the X-Frame-Options Header

This header can be configured by the "x-frame-options" header to control whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object>.