`owasp-headers.mjs`

117 lines and 0 functions in DrDustinEdwards/site-runtime, at commit 89e9d58 on 2026-10-24. This file on GitHub.
Functions

None: it only declares types or values.
Imports

It imports no other module of this repo. Imported by headers.mjs, index.mjs.
Source

1// GENERATED by update-owasp.mjs from the OWASP Secure Headers Project. Do not edit: run the script.
2// Page: https://owasp.org/www-project-secure-headers/
3// Data: https://github.com/OWASP/www-project-secure-headers/tree/master/ci (headers_add.json, headers_remove.json), read 2026-10-06.
4
5/** Where these values were read, and when. */
6export const OWASP_SOURCE = Object.freeze({
7  page: "https://owasp.org/www-project-secure-headers/",
8  data: "https://github.com/OWASP/www-project-secure-headers/tree/master/ci",
9  readOn: "2026-10-06",
10  lastUpdateUtc: "2026-10-04 07:23:38",
11});
12
13/** The headers OSHP recommends a response carry, as OSHP writes them. */
14export const OWASP_RECOMMENDED = Object.freeze({
15  "Cache-Control": "no-store, max-age=0",
16  "Clear-Site-Data": "\"cache\",\"cookies\",\"storage\"",
17  "Content-Security-Policy": "default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests",
18  "Cross-Origin-Embedder-Policy": "require-corp",
19  "Cross-Origin-Opener-Policy": "same-origin",
20  "Cross-Origin-Resource-Policy": "same-origin",
21  "Permissions-Policy": "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=()",
22  "Referrer-Policy": "no-referrer",
23  "Strict-Transport-Security": "max-age=63072000; includeSubDomains",
24  "X-Content-Type-Options": "nosniff",
25  "X-DNS-Prefetch-Control": "off",
26  "X-Frame-Options": "deny",
27  "X-Permitted-Cross-Domain-Policies": "none"
28});
29
30/** The headers OSHP recommends a response not carry (they name the software that served it). */
31export const OWASP_REMOVE = Object.freeze([
32  "$wsep",
33  "Host-Header",
34  "K-Proxy-Request",
35  "Liferay-Portal",
36  "OracleCommerceCloud-Version",
37  "Pega-Host",
38  "Powered-By",
39  "Product",
40  "Server",
41  "SourceMap",
42  "TeamCity-Node-Id",
43  "X-AspNet-Version",
44  "X-AspNetMvc-Version",
45  "X-Atmosphere-error",
46  "X-Atmosphere-first-request",
47  "X-Atmosphere-tracking-id",
48  "X-B3-ParentSpanId",
49  "X-B3-Sampled",
50  "X-B3-SpanId",
51  "X-B3-TraceId",
52  "X-BEServer",
53  "X-Backside-Transport",
54  "X-CF-Powered-By",
55  "X-CMS",
56  "X-CalculatedBETarget",
57  "X-Cocoon-Version",
58  "X-Content-Encoded-By",
59  "X-Datadog-Origin",
60  "X-Datadog-Parent-Id",
61  "X-Datadog-Sampling-Priority",
62  "X-Datadog-Tags",
63  "X-Datadog-Trace-Id",
64  "X-DiagInfo",
65  "X-Envoy-Attempt-Count",
66  "X-Envoy-External-Address",
67  "X-Envoy-Internal",
68  "X-Envoy-Original-Dst-Host",
69  "X-Envoy-Upstream-Service-Time",
70  "X-FEServer",
71  "X-Framework",
72  "X-Generated-By",
73  "X-Generator",
74  "X-Gitlab-Meta",
75  "X-Jitsi-Release",
76  "X-Joomla-Version",
77  "X-Kong-Admin-Latency",
78  "X-Kong-Client-Latency",
79  "X-Kong-Proxy-Latency",
80  "X-Kong-Request-Id",
81  "X-Kong-Response-Latency",
82  "X-Kong-Third-Party-Latency",
83  "X-Kong-Total-Latency",
84  "X-Kong-Upstream-Latency",
85  "X-Kong-Upstream-Status",
86  "X-Kubernetes-PF-FlowSchema-UI",
87  "X-Kubernetes-PF-PriorityLevel-UID",
88  "X-LiteSpeed-Cache",
89  "X-LiteSpeed-Purge",
90  "X-LiteSpeed-Tag",
91  "X-LiteSpeed-Vary",
92  "X-Litespeed-Cache-Control",
93  "X-Mod-Pagespeed",
94  "X-Nextjs-Cache",
95  "X-Nextjs-Matched-Path",
96  "X-Nextjs-Page",
97  "X-Nextjs-Redirect",
98  "X-OWA-Version",
99  "X-Old-Content-Length",
100  "X-OneAgent-JS-Injection",
101  "X-Page-Speed",
102  "X-Php-Version",
103  "X-Powered-By",
104  "X-Powered-By-Plesk",
105  "X-Powered-CMS",
106  "X-Redirect-By",
107  "X-Server-Powered-By",
108  "X-SourceFiles",
109  "X-SourceMap",
110  "X-Turbo-Charged-By",
111  "X-Tyk-Trace-Id",
112  "X-Umbraco-Version",
113  "X-Varnish-Backend",
114  "X-Varnish-Server",
115  "X-Woodpecker-Version",
116  "X-dtAgentId",
117  "X-dtHealthCheck",
118  "X-dtInjectedServlet",
119  "X-ruxit-JS-Agent"
120]);