@@ -42,12 +42,12 @@ SecureConfig struct {
42
42
// XSSProtection provides protection against cross-site scripting attack (XSS)
43
43
// by setting the `X-XSS-Protection` header.
44
44
// Optional. Default value "1; mode=block".
45
- XSSProtection string ` yaml :"xss_protection"`
45
+ XSSProtection string ` json :"xss_protection"`
46
46
47
47
// ContentTypeNosniff provides protection against overriding Content-Type
48
48
// header by setting the `X-Content-Type-Options` header.
49
49
// Optional. Default value "nosniff".
50
- ContentTypeNosniff string ` yaml :"content_type_nosniff"`
50
+ ContentTypeNosniff string ` json :"content_type_nosniff"`
51
51
52
52
// XFrameOptions can be used to indicate whether or not a browser should
53
53
// be allowed to render a page in a <frame>, <iframe> or <object> .
@@ -59,27 +59,27 @@ SecureConfig struct {
59
59
// - "SAMEORIGIN" - The page can only be displayed in a frame on the same origin as the page itself.
60
60
// - "DENY" - The page cannot be displayed in a frame, regardless of the site attempting to do so.
61
61
// - "ALLOW-FROM uri" - The page can only be displayed in a frame on the specified origin.
62
- XFrameOptions string ` yaml :"x_frame_options"`
62
+ XFrameOptions string ` json :"x_frame_options"`
63
63
64
64
// HSTSMaxAge sets the `Strict-Transport-Security` header to indicate how
65
65
// long (in seconds) browsers should remember that this site is only to
66
66
// be accessed using HTTPS. This reduces your exposure to some SSL-stripping
67
67
// man-in-the-middle (MITM) attacks.
68
68
// Optional. Default value 0.
69
- HSTSMaxAge int ` yaml :"hsts_max_age"`
69
+ HSTSMaxAge int ` json :"hsts_max_age"`
70
70
71
71
// HSTSExcludeSubdomains won't include subdomains tag in the `Strict Transport Security`
72
72
// header, excluding all subdomains from security policy. It has no effect
73
73
// unless HSTSMaxAge is set to a non-zero value.
74
74
// Optional. Default value false.
75
- HSTSExcludeSubdomains bool ` yaml :"hsts_exclude_subdomains"`
75
+ HSTSExcludeSubdomains bool ` json :"hsts_exclude_subdomains"`
76
76
77
77
// ContentSecurityPolicy sets the `Content-Security-Policy` header providing
78
78
// security against cross-site scripting (XSS), clickjacking and other code
79
79
// injection attacks resulting from execution of malicious content in the
80
80
// trusted web page context.
81
81
// Optional. Default value "".
82
- ContentSecurityPolicy string ` yaml :"content_security_policy"`
82
+ ContentSecurityPolicy string ` json :"content_security_policy"`
83
83
}
84
84
```
85
85
0 commit comments