Security headers are included in response even when explicitly set to false

[ivanvakulov]

Environment

- Operating System: Darwin
- Node Version:     v22.7.0
- Nuxt Version:     3.14.1592
- CLI Version:      3.16.0
- Nitro Version:    2.10.4
- Package Manager:  [email protected]
- Builder:          -
- User Config:      default
- Runtime Modules:  [email protected]
- Build Modules:    -

Nuxt Security Version

2.1.5

Default setup used?

No, the bug happens only when I set custom values for the security option

Security options

export default defineNuxtConfig({
  security: {
    headers: {
      referrerPolicy: false,
      strictTransportSecurity: false,
      xContentTypeOptions: false,
      xDownloadOptions: false,
      xFrameOptions: false,
      xPermittedCrossDomainPolicies: false,
      xXSSProtection: false,
      contentSecurityPolicy: false,
      permissionsPolicy: false,
      crossOriginEmbedderPolicy: false,
      crossOriginOpenerPolicy: false,
      crossOriginResourcePolicy: false,
      originAgentCluster: false,
      xDNSPrefetchControl: false,
    },
    rateLimiter: false,
    requestSizeLimiter: false,
    xssValidator: false,
    sri: false,
  }
})

Reproduction

Online reproduction: https://stackblitz.com/edit/nuxt-starter-khtpn4ga
To reproduce the issue:

1. Build the application:

yarn build

2. Start the preview server:

yarn preview

3. Inspect the response headers for:

The main HTML document (headers correctly excluded)
Any static file (like .js or .css) where you'll see empty headers being applied
Note: The issue is only visible in production build (preview mode), not in development mode.

Description

When security headers are explicitly set to false in the configuration, they are still being included in the response headers but with empty values. This issue specifically affects headers that are processed by appliesToAllResources function and occurs:

1. For static files (not the main document/HTML file)
2. Only for the following headers (as defined in appliesToAllResources):

• referrerPolicy
• strictTransportSecurity
• xContentTypeOptions
• xDownloadOptions
• xFrameOptions
• xPermittedCrossDomainPolicies
• xXSSProtection

Additional context

Logs

[ivanvakulov]

PR with a fix - #588