[foxable]

Adds responseHeaderReport, which evaluates the headers of a response against recommended security headers and renders the result as a Markdown report for file snapshots. The type option selects the recommendations: document for HTML documents, or api for other responses such as REST or GraphQL endpoints. The report lists the detected security headers, then recommends adding missing headers, changing values that deviate and removing discouraged headers. Values are compared ignoring case and whitespace, and stricter values are accepted. Unrelated headers like date are left out and CSP nonces are masked, so the report stays deterministic. Also adds getResponseHeaders, which extracts the headers from a page response or an APIRequestContext response.

Stacked on #58.

Example

import {
  getResponseHeaders,
  responseHeaderReport,
} from "@cronn/playwright-utils";
import { expect, test } from "@playwright/test";

test("has secure response headers", async ({ page }) => {
  const response = await page.goto("/");
  const headers = await getResponseHeaders(response);

  expect(responseHeaderReport(headers, { type: "document" })).toMatchTextFile({
    fileExtension: "md",
  });
});

## Recommendations

- `strict-transport-security`: Change to `max-age=31536000; includeSubDomains`
- `x-frame-options`: Change to `DENY`

[changeset-bot]

🦋 Changeset detected

Latest commit: ee217c3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cronn/playwright-utils	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR