asseeninmovies: smoke +4 security-header checks (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy). 56/56.

391cd938235289d34e08f5957ef1f8c957f66f83 · 2026-05-13 05:21:35 -0700 · SteveStudio2

Files touched

M test/smoke.js

Diff

commit 391cd938235289d34e08f5957ef1f8c957f66f83
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Wed May 13 05:21:35 2026 -0700

    asseeninmovies: smoke +4 security-header checks (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy). 56/56.
---
 test/smoke.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/test/smoke.js b/test/smoke.js
index fb35bb0..755b754 100644
--- a/test/smoke.js
+++ b/test/smoke.js
@@ -50,6 +50,10 @@ function check(name, cond, hint = '') {
   check('home: SearchAction',  /SearchAction/.test(r.body));
   check('home: favicon',       /rel="icon"/.test(r.body));
   check('home: footer About',  /\/about/.test(r.body));
+  check('home: X-Content-Type-Options',  (r.headers['x-content-type-options'] || '') === 'nosniff');
+  check('home: X-Frame-Options',         /SAMEORIGIN|DENY/.test(r.headers['x-frame-options'] || ''));
+  check('home: Referrer-Policy',         /strict-origin/.test(r.headers['referrer-policy'] || ''));
+  check('home: Permissions-Policy',      /geolocation=/.test(r.headers['permissions-policy'] || ''));
 
   // 2. /movies
   r = await fetch('/movies');

← 999138e asseeninmovies: pin engines.node>=20 in package.json. Mirror · back to AsSeenInMovies · asseeninmovies: home-cache + /api/health expose credits_tota 4996930 →