From d11d647bd1d3a9de35e51070df38d475dd208c04 Mon Sep 17 00:00:00 2001 From: Yusuke Hayashi Date: Thu, 30 Jul 2026 08:22:33 +0900 Subject: [PATCH] security: add HSTS to documentation assets --- scripts/write_headers.py | 1 + tests/test_write_headers.py | 1 + 2 files changed, 2 insertions(+) diff --git a/scripts/write_headers.py b/scripts/write_headers.py index 855e644..04fd390 100644 --- a/scripts/write_headers.py +++ b/scripts/write_headers.py @@ -64,6 +64,7 @@ def render_headers(root: Path) -> str: " Cross-Origin-Resource-Policy: same-origin", " Permissions-Policy: camera=(), geolocation=(), microphone=()", " Referrer-Policy: strict-origin-when-cross-origin", + " Strict-Transport-Security: max-age=31536000; includeSubDomains", " X-Content-Type-Options: nosniff", " X-Frame-Options: DENY", "", diff --git a/tests/test_write_headers.py b/tests/test_write_headers.py index fe16756..4f67e87 100644 --- a/tests/test_write_headers.py +++ b/tests/test_write_headers.py @@ -39,6 +39,7 @@ def test_writes_cloudflare_headers_with_strict_script_policy(tmp_path: Path) -> assert expected_hash(script) in headers assert "script-src 'self'" in headers assert "'unsafe-inline'" not in headers.split("script-src", 1)[1].split(";", 1)[0] + assert "Strict-Transport-Security: max-age=31536000; includeSubDomains" in headers assert "X-Content-Type-Options: nosniff" in headers assert "Cache-Control:" not in headers assert (tmp_path / ".assetsignore").read_text(encoding="utf-8") == ".DS_Store\n"