security: Permissions-Policy header (geolocation/microphone/camera/payment all denied) + 1 smoke

98d376bb90363094ed138208147389e747043bf7 · 2026-05-13 15:11:10 -0700 · SteveStudio2

Files touched

M server.js
M test/smoke.js

Diff

commit 98d376bb90363094ed138208147389e747043bf7
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Wed May 13 15:11:10 2026 -0700

    security: Permissions-Policy header (geolocation/microphone/camera/payment all denied) + 1 smoke
---
 server.js     | 1 +
 test/smoke.js | 1 +
 2 files changed, 2 insertions(+)

diff --git a/server.js b/server.js
index 16b1596..4b84e8a 100644
--- a/server.js
+++ b/server.js
@@ -231,6 +231,7 @@ app.use((req, res, next) => {
   res.setHeader('X-Content-Type-Options', 'nosniff');
   res.setHeader('X-Frame-Options', 'SAMEORIGIN');
   res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+  res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=()');
   next();
 });
 app.use('/css', express.static(path.join(__dirname, 'public/css'), { maxAge: '1h' }));
diff --git a/test/smoke.js b/test/smoke.js
index 9ad2f5f..ae2ec1e 100644
--- a/test/smoke.js
+++ b/test/smoke.js
@@ -89,6 +89,7 @@ function check(name, cond, hint = '') {
   check('home: 200',               r.status === 200);
   check('home: title',             /build-pages/.test(r.body));
   check('home: X-Content-Type-Options', (r.headers['x-content-type-options'] || '') === 'nosniff');
+  check('home: Permissions-Policy', /geolocation=/.test(r.headers['permissions-policy'] || ''));
   check('home: fleet totals',      /\d+ projects · \d+ commits · \d+ design-rationale ideas/.test(r.body));
   check('home: recent rail',       /Recent across the fleet/.test(r.body));
   check('home: theme-color',       /name="theme-color"/.test(r.body));

← d4bc9ad seo: theme-color meta (light + dark variants matching CSS pa · back to build-pages · home: auto-refresh 'Recent across the fleet' rail every 60s 8fd3a31 →