bin/check-security-headers.mjs

Functions

None: it only declares types or values.

Imports

It imports check.mjs. No module of this repo imports it.

Source

1#!/usr/bin/env node
2/**
3 * The header check against live URLs, for a site's CI:
4 *
5 *   node bin/check-security-headers.mjs https://example.com/ https://example.com/admin
6 *
7 * Each URL is fetched without following redirects (a 302 must carry the set too) and graded by
8 * checkSecurityHeaders. Exits 1 on any failure, 2 when a URL cannot be fetched, so an unreachable site
9 * never reads as a pass.
10 */
11
12import { checkSecurityHeaders, failures } from "../check.mjs";
13
14const urls = process.argv.slice(2);
15if (urls.length === 0) {
16  console.error("usage: check-security-headers.mjs <url> [<url> ...]");
17  process.exit(2);
18}
19
20let failed = 0;
21for (const url of urls) {
22  let res;
23  try {
24    res = await fetch(url, { redirect: "manual", headers: { "user-agent": "Mozilla/5.0 (security-headers check)" } });
25  } catch (error) {
26    console.error(`${url}: could not fetch (${error instanceof Error ? error.message : String(error)})`);
27    process.exit(2);
28  }
29  const results = checkSecurityHeaders(res.headers);
30  console.log(`\n${url} (${res.status})`);
31  for (const r of results) console.log(`  ${r.pass ? "ok  " : "FAIL"} ${r.name}${r.pass ? "" : `: ${r.detail}`}`);
32  failed += failures(results).length;
33}
34console.log(`\n${failed === 0 ? "all checks pass" : `${failed} failure(s)`}`);
35process.exit(failed === 0 ? 0 : 1);