workers/security-headers.mjs

Functions

None: it only declares types or values.

Imports

It imports no other module of this repo. Imported by workers/app.ts.

Source

1// The security headers this site sends: the shared package's standard (the OWASP Secure Headers Project's own values) with
2// this site's deviations, each beside the reason for it. In its own module, not in app.ts, so the gate (check:headers) and
3// verify-live import the set instead of parsing source for it, and so the list of deviations is the one place to read what
4// this site does differently from the standard and why.
5
6import { buildSecurityHeaders } from "@dustinedwards/site-runtime/headers";
7
8/**
9 * Looks tightenable and is not. Each entry is a header this site sends differently from OSHP's recommendation; a header
10 * not listed here is OSHP's value exactly. Dustin ratified these values (the gate's RATIFIED set holds them), and none is
11 * changed by the package: CORP `same-origin` would break off-site og:image previews; COOP is left loose so cross-origin
12 * popups and redirects keep working; HSTS carries `includeSubDomains` (we own the apex, and every subdomain serves valid
13 * HTTPS, checked 2026-10-03) and never `preload`, a one-way door. Never deny `clipboard-write`: the copy
14 * controls swallow the refusal silently.
15 *
16 * @type {Readonly<Record<string, import("@dustinedwards/site-runtime/headers").HeaderOverride>>}
17 */
18export const SITE_HEADER_OVERRIDES = Object.freeze({
19  "Strict-Transport-Security": {
20    value: "max-age=31536000; includeSubDomains",
21    reason: "One year with includeSubDomains is the ratified value, and preload is never sent (a one-way door). OSHP's two years has not been ruled on for this site.",
22  },
23  "Referrer-Policy": {
24    value: "strict-origin-when-cross-origin",
25    reason: "The ratified value for this site. OSHP recommends no-referrer, which is stricter and has not been ruled on for this site.",
26  },
27  // One string literal, never a concatenation.
28  "Permissions-Policy": {
29    value: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(), midi=(), display-capture=()",
30    reason: "clipboard-write must stay allowed: the copy controls swallow the refusal silently. OSHP's longer list denies it, and has not been ruled on feature by feature for this site.",
31  },
32  "Cross-Origin-Opener-Policy": {
33    value: "same-origin-allow-popups",
34    reason: "Plain same-origin would sever the opener of any cross-origin popup a sign-in or embed opens; allow-popups keeps that working and is the ratified value.",
35  },
36  "Cross-Origin-Resource-Policy": {
37    value: "cross-origin",
38    reason: "same-origin would block social platforms fetching og:image from /media/og/*; the failure is off-site, silent and invisible from this repo.",
39  },
40});
41
42/** The set this site sends: the standard and the deviations above. */
43export const SECURITY_HEADERS = Object.freeze(buildSecurityHeaders({ overrides: SITE_HEADER_OVERRIDES }));