TsgcHTTPServer › Properties › SecurityOptions
Handshake admission rules inherited from the shared server engine; the handshake checks only apply to the WebSocket upgrade path and never trigger on this component, but HSTS_Options does apply here (see Remarks).
property SecurityOptions: TsgcWSSecurity_Options read FSecurityOptions write SetSecurityOptions;| Name | Default | Description |
|---|---|---|
OriginsAllowed | "" | Comma-separated whitelist of origins accepted for browser WebSocket handshakes. Empty allows all origins. |
EnforceWebSocketVersion | True | Rejects an RFC 6455 handshake whose Sec-WebSocket-Version is not 13. |
ValidateWebSocketKey | True | Rejects an RFC 6455 handshake whose Sec-WebSocket-Key is not a valid 16-byte base64 nonce. |
HSTS_Options.Enabled | False | Enables the Strict-Transport-Security response header. See Remarks. |
HSTS_Options.MaxAge | 31536000 | Value in seconds for the header's max-age directive (default is one year). SSL Labs requires at least 15552000 (six months) for an A+ rating. |
HSTS_Options.IncludeSubDomains | False | Adds includeSubDomains to the header. Enable only if every subdomain is served over HTTPS. |
HSTS_Options.Preload | False | Adds preload to the header. Enable only for domains submitted to the browsers' HSTS preload list. |
SecurityOptions is inherited unchanged from the shared server engine that also powers TsgcWebSocketHTTPServer, where OriginsAllowed, EnforceWebSocketVersion and ValidateWebSocketKey gate the WebSocket upgrade handshake. TsgcHTTPServer never performs a WebSocket handshake, so none of these three checks ever run on this component: every request is handled by the plain HTTP path (OnCommandGet / OnCommandOther / DocumentRoot). These three members remain published for interface compatibility with the shared engine; leave them at their default values. To restrict which client IPs can reach an HTTP endpoint use Firewall or RateLimiter, or inspect the Origin header yourself inside OnBeforeCommand.
HSTS_Options is the exception: it does apply to this component. It controls the Strict-Transport-Security response header defined by RFC 6797. When Enabled is True, every response sent over TLS includes a Strict-Transport-Security header built from MaxAge, IncludeSubDomains and Preload, for example Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. The header is never sent over plain HTTP, is skipped if the application already set a Strict-Transport-Security header on the response, and is not added to responses whose headers the application writes itself (streaming). HSTS_Options is available on this component and on TsgcWebSocketHTTPServer only; it has no effect on TsgcWebSocketServer or the http.sys server TsgcWebSocketServer_HTTPAPI.
OriginsAllowed, EnforceWebSocketVersion and ValidateWebSocketKey are shown for completeness; they have no observable effect on TsgcHTTPServer. HSTS_Options.Enabled and HSTS_Options.MaxAge do have an effect: they add the Strict-Transport-Security header to responses sent over TLS.
oServer := TsgcHTTPServer.Create(nil);
oServer.SecurityOptions.OriginsAllowed := 'http://127.0.0.1:*';
oServer.SecurityOptions.EnforceWebSocketVersion := true;
oServer.SecurityOptions.ValidateWebSocketKey := true;
oServer.SecurityOptions.HSTS_Options.Enabled := true;
oServer.SecurityOptions.HSTS_Options.MaxAge := 31536000;
oServer.Active := true;