Erweiterte Header für Nuxt 3 konfigurieren

// nuxt.config.ts — Erweiterte Header mit nuxt-security
export default defineNuxtConfig({
  modules: ['nuxt-security'],

  security: {
    headers: {
      // Origin-Agent-Cluster: Prozess-Isolation
      'Origin-Agent-Cluster': '?1',

      // DNS-Prefetch deaktivieren (Privacy)
      'X-DNS-Prefetch-Control': 'off',

      // Cross-Domain-Policies blockieren
      'X-Permitted-Cross-Domain-Policies': 'none',

      // Cross-Origin Isolation (optional, strikt)
      'Cross-Origin-Opener-Policy': 'same-origin',
      'Cross-Origin-Embedder-Policy': 'require-corp',
      'Cross-Origin-Resource-Policy': 'same-origin',
    },
  },
})

// nuxt.config.ts — routeRules ohne nuxt-security
export default defineNuxtConfig({
  routeRules: {
    '/**': {
      headers: {
        'Origin-Agent-Cluster': '?1',
        'X-DNS-Prefetch-Control': 'off',
        'X-Permitted-Cross-Domain-Policies': 'none',
      },
    },
    // API-Routen: zusätzliche Isolation
    '/api/**': {
      headers: {
        'Origin-Agent-Cluster': '?1',
        'X-DNS-Prefetch-Control': 'off',
        'X-Permitted-Cross-Domain-Policies': 'none',
        'Cross-Origin-Resource-Policy': 'same-origin',
      },
    },
  },
})

// server/middleware/advanced-headers.ts
// Nitro Middleware für maximale Kontrolle
export default defineEventHandler((event) => {
  const headers = {
    'Origin-Agent-Cluster': '?1',
    'X-DNS-Prefetch-Control': 'off',
    'X-Permitted-Cross-Domain-Policies': 'none',
    'Cross-Origin-Opener-Policy': 'same-origin',
    'Cross-Origin-Resource-Policy': 'same-origin',
  };

  for (const [key, value] of Object.entries(headers)) {
    setHeader(event, key, value);
  }
})