koa-lusca

Web application security middleware for koa, forked from krakenjs/lusca. Version 2.2.0 provides CSRF protection, Content Security Policy (CSP), X-Frame-Options (clickjacking), P3P privacy headers, HSTS, and XSS protection. This package is actively maintained but does not support Koa v2 (async/await) or modern ESM. Release cadence is low; last update was 2019. Key differentiator: it brings lusca-style security to Koa v1, but developers should consider alternatives like 'koa-helmet' for Koa v2.