javier
6b6389cb0f
This PR contains the work done to add a `SecurityHeadersMiddleware` middleware that stamps hardened security-related HTTP headers onto every response. To provide further details about the work: * Implemented the `SecurityHeadersMiddleware` middleware, which precomputes headers once from a `Configuration` object and applies them to every response: * _Content-Security-Policy_, * _X-Content-Type-Options_, * _X-Frame-Options_, * _Referrer-Policy_, * _Permissions-Policy_, * _Strict-Transport-Security_ (optional). * Integrated this middleware into the router (near the top of the chain), reading each value from configuration with hardened defaults. * The _Strict-Transport-Security_ has no default value — omitted unless explicitly set, so it stays off in plain-HTTP during development and on only behind TLS. * Added security-header constants keys and values. Reviewed-on: rock-n-code/loud-amsterdam#8 Co-authored-by: Javier Cicchelli <javier@rock-n-code.com> Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>
11 lines
489 B
Swift
11 lines
489 B
Swift
import HTTPTypes
|
|
|
|
extension HTTPField.Name {
|
|
/// The `Permissions-Policy` field name (not provided as a standard `HTTPField.Name`).
|
|
static let permissionsPolicy = Self("Permissions-Policy")!
|
|
/// The `Referrer-Policy` field name (not provided as a standard `HTTPField.Name`).
|
|
static let referrerPolicy = Self("Referrer-Policy")!
|
|
/// The `X-Frame-Options` field name (not provided as a standard `HTTPField.Name`).
|
|
static let frameOptions = Self("X-Frame-Options")!
|
|
}
|