starsofdesign: smoke +4 security-header checks (X-Content-Type-Options, Referrer-Policy, HSTS, CSP via helmet). 46/46.

c9d3997d30a38560c6ebcece9438598d997c773d · 2026-05-13 05:24:45 -0700 · Steve Abrams

Files touched

M test/smoke.js

Diff

commit c9d3997d30a38560c6ebcece9438598d997c773d
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed May 13 05:24:45 2026 -0700

    starsofdesign: smoke +4 security-header checks (X-Content-Type-Options, Referrer-Policy, HSTS, CSP via helmet). 46/46.
---
 test/smoke.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/test/smoke.js b/test/smoke.js
index 6855f9f..4b29464 100644
--- a/test/smoke.js
+++ b/test/smoke.js
@@ -48,6 +48,10 @@ function check(name, cond, hint = '') {
   check('home: favicon',       /rel="icon"/.test(r.body));
   check('home: footer Privacy',/\/privacy/.test(r.body));
   check('home: footer Terms',  /\/terms/.test(r.body));
+  check('home: X-Content-Type-Options', (r.headers['x-content-type-options'] || '') === 'nosniff');
+  check('home: Referrer-Policy',        /strict-origin/.test(r.headers['referrer-policy'] || ''));
+  check('home: Strict-Transport-Security', /max-age=/.test(r.headers['strict-transport-security'] || ''));
+  check('home: CSP',                    /default-src/.test(r.headers['content-security-policy'] || ''));
 
   // 2. /designers
   r = await fetch('/designers');

← 0160b3c sodhz · back to Stars of Design · sod-smoke-quiet 5379dd0 →