security-header-generator

Security headers like CSP and HSTS protect against XSS, clickjacking, and MITM attacks by controlling browser behavior and enforcing encrypted connections. This Skill generates framework-specific configurations for Node.js, Express, Next.js, and nginx that implement these headers with recommended defaults, so you configure them once in your deployment environment.

Yes. This Skill provides framework-specific configurations for both Express and Next.js, including examples for setting CSP directives, HSTS policies, X-Frame-Options, and CORS headers directly in your application middleware or server configuration.

CSP controls which resources a browser can load to prevent XSS attacks. CORS manages cross-origin requests. HSTS enforces HTTPS. X-Frame-Options blocks clickjacking. Each header addresses a specific threat; this Skill configures all of them together with precise directives and policies for realistic deployment scenarios.

CORS headers control which origins can access your API, while Referrer-Policy determines what referrer information is sent with requests. This Skill generates both configurations with strict defaults and framework-specific syntax for Express, Next.js, and nginx to satisfy deployment requirements.

Yes. nginx uses server blocks and add_header directives, while Node.js frameworks like Express use middleware. This Skill provides environment-specific configurations so you apply the same security policies with the correct syntax for each deployment target.