security-txt.mjs

Functions

Imports

It imports no other module of this repo. No module of this repo imports it.

Source

1/**
2 * /.well-known/security.txt (RFC 9116), once, for every site: where to report a vulnerability, before a finder decides
3 * a public post is the only channel.
4 *
5 * `expires` is required, as the RFC requires the field. A fixed date is the safer choice: a file that renews itself on
6 * every request keeps vouching for a contact nobody has checked. A site that does pass a computed date should keep it
7 * under a year out, as the RFC recommends.
8 */
9
10/**
11 * @typedef {{ origin: string, contact: string, expires: Date | string, policy?: string, languages?: string }} SecurityTxt
12 */
13
14/**
15 * The file's text: Contact, Expires, Policy when given, Preferred-Languages and Canonical (the site's own URL for it,
16 * so a copy found elsewhere is known to be one). `contact` is an email address or a URL.
17 * @param {SecurityTxt} fields
18 * @returns {string}
19 */
20export function securityTxt({ origin, contact, expires, policy, languages = "en" }) {
21  const when = new Date(expires);
22  if (Number.isNaN(when.getTime())) throw new TypeError("security.txt needs an Expires date");
23  return [
24    `Contact: ${contact.includes(":") ? contact : `mailto:${contact}`}`,
25    `Expires: ${when.toISOString().replace(/\.\d{3}Z$/, "Z")}`,
26    ...(policy ? [`Policy: ${policy}`] : []),
27    `Preferred-Languages: ${languages}`,
28    `Canonical: ${origin.replace(/\/$/, "")}/.well-known/security.txt`,
29    "",
30  ].join("\n");
31}
32
33/**
34 * The file as a response: text/plain, cached for an hour. `headers` adds to or replaces those.
35 * @param {SecurityTxt} fields
36 * @param {HeadersInit} [headers]
37 * @returns {Response}
38 */
39export function securityTxtResponse(fields, headers) {
40  const merged = new Headers({ "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "public, max-age=3600" });
41  for (const [name, value] of new Headers(headers)) merged.set(name, value);
42  return new Response(securityTxt(fields), { headers: merged });
43}