-
Notifications
You must be signed in to change notification settings - Fork 0
security(http): apply runtime response-header policy without severity overclaim #660
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft
seonghobae
wants to merge
2
commits into
develop
Choose a base branch
from
sentinel-security-headers-11638118127264155143
base: develop
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+57
−3
Draft
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| import { Hono } from 'hono'; | ||
| import { secureHeaders } from 'hono/secure-headers'; | ||
| import { app } from './app.mjs'; | ||
|
|
||
| export const runtimeApp = new Hono(); | ||
|
|
||
| // Apply security headers to all routes | ||
| runtimeApp.use('*', secureHeaders()); | ||
|
|
||
| // Mount the canonical application | ||
| runtimeApp.route('/', app); | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| import { serve } from '@hono/node-server'; | ||
| import { app } from './app.mjs'; | ||
| import { runtimeApp } from './runtime-app.mjs'; | ||
|
|
||
| const port = Number(process.env.PORT) || 8787; | ||
| serve({ fetch: app.fetch, port }, (info) => { | ||
| serve({ fetch: runtimeApp.fetch, port }, (info) => { | ||
| console.log(`ScopeWeave API listening on http://localhost:${info.port}`); | ||
| }); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| import assert from 'node:assert'; | ||
| import { runtimeApp } from '../../server/runtime-app.mjs'; | ||
| import { app } from '../../server/app.mjs'; | ||
|
|
||
| async function verifyHeaders(res, path, expectedStatus) { | ||
| assert.equal(res.status, expectedStatus, `Expected status ${expectedStatus} for ${path}`); | ||
| assert.equal(res.headers.get('x-content-type-options'), 'nosniff', `Missing/incorrect nosniff on ${path}`); | ||
| assert.equal(res.headers.get('x-frame-options'), 'SAMEORIGIN', `Missing/incorrect SAMEORIGIN on ${path}`); | ||
| // Exact configured HSTS value expected from Hono's default secureHeaders | ||
| assert.equal(res.headers.get('strict-transport-security'), 'max-age=15552000; includeSubDomains', `Missing/incorrect exact HSTS on ${path}`); | ||
| } | ||
|
|
||
| async function runTests() { | ||
| // Test behavior parity before/after header application on domain/body/status | ||
| const appRes = await app.request('/api/health'); | ||
| const runtimeRes = await runtimeApp.request('/api/health'); | ||
|
|
||
| assert.equal(runtimeRes.status, appRes.status, 'Status behavior differs between app and runtime'); | ||
| assert.equal(await runtimeRes.text(), await appRes.text(), 'Body behavior differs between app and runtime'); | ||
|
|
||
| // 1. 2xx OK path | ||
| let res = await runtimeApp.request('/api/health'); | ||
| await verifyHeaders(res, '/api/health', 200); | ||
|
|
||
| // 2. 401 Unauthorized path (no token) | ||
| res = await runtimeApp.request('/api/me'); | ||
| await verifyHeaders(res, '/api/me', 401); | ||
|
|
||
| // 3. 404 Not Found path | ||
| res = await runtimeApp.request('/api/does-not-exist'); | ||
| await verifyHeaders(res, '/api/does-not-exist', 404); | ||
|
|
||
| console.log('✓ API security header tests passed (across 200, 401, 404 paths with exact HSTS)'); | ||
| } | ||
|
|
||
| runTests().catch(err => { | ||
| console.error(err); | ||
| process.exit(1); | ||
| }); |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: ContextualWisdomLab/scopeweave
Length of output: 50389
🏁 Script executed:
Repository: ContextualWisdomLab/scopeweave
Length of output: 41621
🤖 get_repo_knowledge executed:
get_repo_knowledge ContextualWisdomLab/scopeweave /tmp/coderabbit-repo-knowledge/contextualwisdomlab-scopeweave-647613e1/conventionsLength of output: 1613
🌐 Web query:
Hono 4.13.0 secureHeaders default Strict-Transport-Security includeSubDomains💡 Result:
In Hono version 4.13.0, the secureHeaders middleware includes the Strict-Transport-Security (STS) header by default [1][2]. The default value applied is "max-age=15552000; includeSubDomains" [1][2][3]. When you use the secureHeaders middleware without custom configuration, this STS policy is automatically active [1][3]. If you wish to customize or disable this behavior, you can override the strictTransportSecurity option in the configuration object passed to the middleware [1][4]. For example, to provide a custom STS value: secureHeaders({ strictTransportSecurity: 'max-age=31536000; includeSubDomains; preload;' }) To disable the STS header entirely: secureHeaders({ strictTransportSecurity: false })
Citations:
🏁 Script executed:
Repository: ContextualWisdomLab/scopeweave
Length of output: 15985
HSTS의 하위 도메인 범위를 명시하세요.
runtimeApp의 HonosecureHeaders()는 기본적으로Strict-Transport-Security: max-age=15552000; includeSubDomains를 적용합니다. 부모 도메인에 HTTP만 지원하는 하위 도메인이 있으면 브라우저가 해당 요청을 HTTPS로 변경하여 가용성을 저해할 수 있습니다. 해당 하위 도메인이 존재하면 HTTPS를 제공하거나strictTransportSecurity옵션으로 범위를 명시하세요.🤖 Prompt for AI Agents
Source: MCP tools