Ryan/Reactive-Resume
1
0
Fork 0
mirror of https://github.com/AmruthPillai/Reactive-Resume.git synced 2026-08-22 06:12:17 +10:00
Code Issues Packages Projects Releases Wiki Activity

feat(server): add CSP report-only and framing headers to web responses

Browse Source 
Add X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a report-only CSP to every HTML fallback response via a shared constant. Remove the unconditional Access-Control-Allow-Origin header from the same-origin uploads endpoint (CORP: same-site already covers it).
This commit is contained in:
Amruth Pillai
2026-07-08 15:50:13 +02:00
parent 73daf22b2f
commit 9bde7d544f
4 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/server/src/static/web.test.ts
+9
View File
@@ -32,6 +32,15 @@ describe("web app fallback classification", () => {
expect(await response.text()).toBe("<html>app</html>");
});
it.each(["/", "/alice/resume"])("sets framing and report-only CSP security headers on %s", async (pathname) => {
const response = await handleWebApp(new Request(`https://example.com${pathname}`));
expect(response.status).toBe(200);
expect(response.headers.get("X-Frame-Options")).toBe("DENY");
expect(response.headers.get("X-Content-Type-Options")).toBe("nosniff");
expect(response.headers.get("Content-Security-Policy-Report-Only")).toContain("frame-ancestors 'none'");
});
it.each([
"/auth/login",
"/dashboard",