middleware/security.ts

Sets HTTP security headers for Cloudflare Workers to protect against common web vulnerabilities.

// Source: https://github.com/cfworker/cfworker | License: MIT | Copyright 2020 Jeremy Danyow
// Provided via justclaw.it.com; keep this notice with the code.
import { Middleware } from '@cfworker/web';
import { cssHash } from '../inline-styles';

export const securityMiddleware: Middleware = async ({ res }, next) => {
  const [hash] = await Promise.all([cssHash, next()]);

  // hsts
  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
  // https://hstspreload.org/
  res.headers.set(
    'Strict-Transport-Security',
    'max-age=63072000; includeSubDomains; preload'
  );

  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
  res.headers.set('X-Content-Type-Options', 'nosniff');

  // https://developer.mozilla.org/en-US/d

... (truncated -- full source via MCP)