Built-in Middlewares

Security and Utility Middlewares

Discover built-in middlewares for security headers, CSRF defense, body size limits, ETags, Server-Timing, and response compression.

Taser bundles a suite of production-grade security and performance utility middlewares.

Secure Headers (@taserjs/router/secure-headers)

Sets standard HTTP security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Content-Security-Policy):

src/routes/$.ts
import { secureHeaders } from "@taserjs/router/secure-headers";
import { t } from "@taserjs/router";

export default t.layout("/*").use(
  secureHeaders({
    contentSecurityPolicy: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'"],
    },
    strictTransportSecurity: {
      maxAge: 31536000,
      includeSubDomains: true,
      preload: true,
    },
    xFrameOptions: "DENY",
    xContentTypeOptions: "nosniff",
  }),
);

Body Size Limits (@taserjs/router/body-limit)

Prevents denial-of-service memory exhaustion by enforcing maximum request body limits:

src/routes/uploads.ts
import { bodyLimit } from "@taserjs/router/body-limit";
import { payloadTooLarge } from "@taserjs/router/reply";
import { t } from "@taserjs/router";

export default t.layout("/uploads").use(
  bodyLimit({
    maxSize: 10 * 1024 * 1024, // 10MB limit
    onError: () => {
      return payloadTooLarge({ message: "Payload too large. Maximum size is 10MB." });
    },
  }),
);

CSRF Defense (@taserjs/router/csrf)

Validates incoming request origin against server origins to prevent cross-site request forgery attacks on state-changing requests (POST, PUT, PATCH, DELETE):

src/routes/$.ts
import { csrf } from "@taserjs/router/csrf";
import { t } from "@taserjs/router";

export default t.layout("/*").use(
  csrf({
    origin: ["https://app.example.com"],
  }),
);

Automatic ETags (@taserjs/router/etag)

Calculates cryptographic hash ETags for response bodies and automatically responds with 304 Not Modified when clients send a matching If-None-Match header:

src/routes/$.ts
import { etag } from "@taserjs/router/etag";
import { t } from "@taserjs/router";

export default t.layout("/*").use(
  etag({
    weak: true,
  }),
);

Server-Timing (@taserjs/router/timing)

Adds standard Server-Timing headers to responses, enabling Chrome DevTools and observability platforms to measure internal route latency:

src/routes/$.ts
import { timing } from "@taserjs/router/timing";
import { t } from "@taserjs/router";

export default t.layout("/*").use(timing());

Response Compression (@taserjs/router/compress)

Automatically compresses outgoing HTTP response payloads using gzip, deflate, or brotli based on client Accept-Encoding:

src/routes/$.ts
import { compress } from "@taserjs/router/compress";
import { t } from "@taserjs/router";

export default t.layout("/*").use(
  compress({
    threshold: 1024, // Compress responses larger than 1KB
  }),
);

Summary of Built-in Middlewares

Middleware ImportPackagePrimary Purpose
cors@taserjs/router/corsCross-Origin Resource Sharing
jwt@taserjs/router/jwtHMAC/RSA Bearer Token Verification
jwk@taserjs/router/jwkRemote JSON Web Key Set Auth
secureHeaders@taserjs/router/secure-headersCSP, HSTS, X-Frame-Options
bodyLimit@taserjs/router/body-limitMemory protection payload limiting
csrf@taserjs/router/csrfCross-Site Request Forgery mitigation
etag@taserjs/router/etag304 Cache validation
timing@taserjs/router/timingServer-Timing performance metrics
compress@taserjs/router/compressGzip / Deflate payload compression

JWT and JWKS Authentication

Verify JSON Web Tokens (JWT) and remote JWKS key sets (Auth0, Clerk, Supabase) with built-in typed authentication middleware for Taser APIs.

Standalone API

Build standalone, zero-host HTTP APIs with pure Taser, Vite, and Nitro. Maximum throughput, zero boilerplate, and web-standard Request/Response execution.

On this page

Secure Headers (@taserjs/router/secure-headers)Body Size Limits (@taserjs/router/body-limit)CSRF Defense (@taserjs/router/csrf)Automatic ETags (@taserjs/router/etag)Server-Timing (@taserjs/router/timing)Response Compression (@taserjs/router/compress)Summary of Built-in Middlewares