Helmet & CORS

The 4.0.0 HTTP adapter uses Fastify-compatible Helmet and CORS integrations. Configure them through FastifyHttpOptions, rather than passing Express middleware.

import type {FastifyHttpOptions} from '@heronjs/express';
 
export const httpOptions: FastifyHttpOptions = {
  cors: {origin: 'https://example.test', methods: ['GET', 'POST']},
  helmet: {referrerPolicy: {policy: 'no-referrer'}},
  fastify: {trustProxy: false, bodyLimit: 1024 * 1024},
};
// await app.listen({port: 3000, options: httpOptions});

Use cors: false to disable CORS registration. Sessions are enabled when configured, using a validated session secret and appropriate cookie settings. MCP and ACP also enforce their own Host/Origin allowlists; HTTP CORS does not replace those checks.

See Fastify configuration for hooks, plugins, parsers and shutdown behavior.