incremental
diff --git a/src/security_headers_middleware.cpp b/src/security_headers_middleware.cpp
index bcaa87d..265cda7 100644
--- a/src/security_headers_middleware.cpp
+++ b/src/security_headers_middleware.cpp
@@ -2,19 +2,38 @@
namespace crow {
+static const std::string strict_transport_security_key =
+ "Strict-Transport-Security";
+static const std::string strict_transport_security_value =
+ "max-age=31536000; includeSubdomains; preload";
+
+static const std::string ua_compatability_key = "X-UA-Compatible";
+static const std::string ua_compatability_value = "IE=11";
+
+static const std::string xframe_key = "X-Frame-Options";
+static const std::string xframe_value = "DENY";
+
+static const std::string xss_key = "X-XSS-Protection";
+static const std::string xss_value = "1; mode=block";
+
+static const std::string content_security_key = "X-Content-Security-Policy";
+static const std::string content_security_value = "default-src 'self'";
+
void SecurityHeadersMiddleware::before_handle(crow::request& req, response& res,
context& ctx) {}
void SecurityHeadersMiddleware::after_handle(request& /*req*/, response& res,
context& ctx) {
- // TODO(ed) these should really check content types. for example, X-UA-Compatible
- // header doesn't make sense when retrieving a JSON or javascript file. It doesn't
- // hurt anything, it's just ugly.
- res.set_header("Strict-Transport-Security",
- "max-age=31536000; includeSubdomains; preload");
- res.set_header("X-UA-Compatible", "IE=11");
- res.set_header("X-Frame-Options", "DENY");
- res.set_header("X-XSS-Protection", "1; mode=block");
- res.set_header("X-Content-Security-Policy", "default-src 'self'");
+ /*
+ TODO(ed) these should really check content types. for example,
+ X-UA-Compatible header doesn't make sense when retrieving a JSON or
+ javascript file. It doesn't hurt anything, it's just ugly.
+ */
+ res.add_header(strict_transport_security_key,
+ strict_transport_security_value);
+ res.add_header(ua_compatability_key, ua_compatability_value);
+ res.add_header(xframe_key, xframe_value);
+ res.add_header(xss_key, xss_value);
+ res.add_header(content_security_key, content_security_value);
}
}