@stacksjs/router/dist/security-headers.js

The Stacks framework router.

import process from "node:process";
let _isProductionCache, _isDisabledCache, _cspCache;
function isProduction() {
  if (_isProductionCache !== void 0)
    return _isProductionCache;
  _isProductionCache = (process.env.APP_ENV ?? process.env.NODE_ENV ?? "").toLowerCase() === "production";
  return _isProductionCache;
}
function isDisabled() {
  if (_isDisabledCache !== void 0)
    return _isDisabledCache;
  _isDisabledCache = process.env.STACKS_SECURITY_HEADERS_DISABLE === "true";
  return _isDisabledCache;
}
function resolveCsp() {
  if (_cspCache !== void 0)
    return _cspCache;
  const enforce = process.env.STACKS_CSP, report = process.env.STACKS_CSP_REPORT_ONLY;
  if (enforce)
    _cspCache = { header: "Content-Security-Policy", value: enforce };
  else if (report)
    _cspCache = { header: "Content-Security-Policy-Report-Only", value: report };
  else
    _cspCache = null;
  return _cspCache;
}
export function applySecurityHeaders(headers) {
  if (isDisabled())
    return;
  if (!headers.has("X-Content-Type-Options"))
    headers.set("X-Content-Type-Options", "nosniff");
  if (!headers.has("X-Frame-Options"))
    headers.set("X-Frame-Options", "SAMEORIGIN");
  if (!headers.has("Referrer-Policy"))
    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
  if (isProduction() && !headers.has("Strict-Transport-Security"))
    headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
  const csp = resolveCsp();
  if (csp && !headers.has(csp.header))
    headers.set(csp.header, csp.value);
}
export function __resetSecurityHeadersCache() {
  _isProductionCache = void 0;
  _isDisabledCache = void 0;
  _cspCache = void 0;
}