Security · Package reference

@wrnexus/security

Security headers, CSRF protection, rate limits, and safe rendering.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/security@0.8.7

Request preview access. Never put registry tokens in source control.

Secure-by-default utilities for WRNexusJS: bounded HTML-safe serialization, prototype-pollution rejection, URL policy, secure cookies, request hardening, security presets, and SSRF-safe remote fetches.

import { safeFetch, securityPreset, setSecureCookie } from "@wrnexus/security";

export default { security: securityPreset("strict") };
const response = await safeFetch(remoteUrl, { allowedHosts: ["api.example.com"] });
setSecureCookie(ctx, "__Host-session", sessionId);

Complete TypeScript API

Generated from the exact installed package declarations.

export { S as SafeFetchOptions, a as SafeUrlPolicy, i as isPrivateAddress, b as isSafeUrl, s as safeFetch, c as sanitizeUrl, v as validateUrl } from './fetch-DzQ8J9S2.js';
export { SecureSerializeOptions, secureJsonStringify, serializeForHtml } from './serialization.js';
import { CookieOptions, Context, RequestLimitsConfig, Middleware, SecurityConfig } from '@wrnexus/core';
export { TrustedHtmlPolicy, TrustedHtmlValue, createTrustedHtml, isTrustedHtml, unwrapTrustedHtml } from './trusted-html.js';

declare class SecurityError extends Error {
    readonly code: string;
    readonly status: number;
    constructor(code: string, message: string, status?: number, options?: ErrorOptions);
}

interface SafeObjectOptions {
    maxDepth?: number;
    maxKeys?: number;
    allowInstances?: boolean;
}
declare function isDangerousObjectKey(key: string): boolean;
declare function assertSafeObject(value: unknown, options?: SafeObjectOptions): void;
declare function safeMerge<T extends Record<string, unknown>>(target: T, ...sources: Array<Record<string, unknown> | undefined | null>): T;

interface SecureCookieOptions extends CookieOptions {
    hostOnly?: boolean;
}
declare function secureCookieOptions(ctx: Pick<Context, "url">, options?: SecureCookieOptions): CookieOptions;
declare function setSecureCookie(ctx: Pick<Context, "url" | "cookies">, name: string, value: string, options?: SecureCookieOptions): void;

type RequestHardeningOptions = RequestLimitsConfig;
declare function requestHardening(options?: RequestHardeningOptions): Middleware;

type SecurityPreset = "balanced" | "strict" | "api";
declare function securityPreset(preset?: SecurityPreset): SecurityConfig;

export { type RequestHardeningOptions, type SafeObjectOptions, type SecureCookieOptions, SecurityError, type SecurityPreset, assertSafeObject, isDangerousObjectKey, requestHardening, safeMerge, secureCookieOptions, securityPreset, setSecureCookie };

Examples

Copy-ready examples from the installed package documentation.

Secure-by-default utilities for WRNexusJS: bounded HTML-safe serialization, prototype-pollution rejection, URL policy, secure cookies, request hardening, security presets, and SSRF-safe remote fetches.

import { safeFetch, securityPreset, setSecureCookie } from "@wrnexus/security";

export default { security: securityPreset("strict") };
const response = await safeFetch(remoteUrl, { allowedHosts: ["api.example.com"] });
setSecureCookie(ctx, "__Host-session", sessionId);

Install @wrnexus/security

bun add @wrnexus/security