smoke: assert HSTS + CSP headers (helmet regression guard)

338bd3e580881c33b646112d5e16bd13ee7dbf79 · 2026-05-13 10:32:44 -0700 · Steve Abrams

Files touched

M test/smoke.js

Diff

commit 338bd3e580881c33b646112d5e16bd13ee7dbf79
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed May 13 10:32:44 2026 -0700

    smoke: assert HSTS + CSP headers (helmet regression guard)
---
 test/smoke.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/test/smoke.js b/test/smoke.js
index 34f69e5..20fe913 100644
--- a/test/smoke.js
+++ b/test/smoke.js
@@ -158,6 +158,11 @@ function check(name, cond, hint = '') {
   check('gzip /firms',                 (r.headers['content-encoding'] || '') === 'gzip');
   check('vary Accept-Encoding',        (r.headers['vary'] || '').toLowerCase().includes('accept-encoding'));
 
+  // helmet security headers — sod uses helmet, asim doesn't, so this is sod-only.
+  r = await fetch('/');
+  check('HSTS header',                 /max-age=\d+/.test(r.headers['strict-transport-security'] || ''));
+  check('CSP header',                  /default-src/.test(r.headers['content-security-policy'] || ''));
+
   // 10. legal pages
   r = await fetch('/about');
   check('about: 200',                  r.status === 200);

← e88edf9 smoke: assert Vary: Accept-Encoding · back to Stars of Design · smoke: assert X-Frame-Options on home (asim parity) 4be3a23 →